grthtrhthjhtyjytjytkergtrhtrjytjerhrfh4:24 29/09/2026Return-Path: Delivered-To: jagonzalez@bagno-company.com Received: from ambar.servidorlinux16.com by ambar.servidorlinux16.com with LMTP id XPuYLHqJv2qarh4Am9P8sg (envelope-from ) for ; Fri, 02 Oct 2026 07:37:46 -0300 Return-path: Envelope-to: jagonzalez@bagno-company.com Delivery-date: Fri, 02 Oct 2026 07:37:46 -0300 Received: from r200-125-33-206.ae-static.anteldata.net.uy ([200.125.33.206]:59532 helo=storagecentral.bagno.company.com) by ambar.servidorlinux16.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xCaeA-00000008R5H-2wRt for jagonzalez@bagno-company.com; Fri, 02 Oct 2026 07:37:46 -0300 Received: by storagecentral.bagno.company.com (Postfix, from userid 0) id 948C97A05EB; Fri, 2 Oct 2026 07:37:43 -0300 (-03) To: jagonzalez@bagno-company.com Subject: [storagecentral.bagno.company.com] 75 package update(s) available MIME-Version: 1.0 Content-type: text/plain; charset=UTF-8 Content-transfer-encoding: 8bit Message-Id: <20261002103743.948C97A05EB@storagecentral.bagno.company.com> Date: Fri, 2 Oct 2026 07:37:43 -0300 (-03) From: root apticron report [Fri, 02 Oct 2026 07:37:24 -0300] ======================================================================== apticron has detected that some packages need upgrading on: storagecentral.bagno.company.com [ 192.168.1.70 ] The following packages are currently pending an upgrade: base-files 12.4+deb12u15 bash 5.2.15-2+b13 btrfs-progs 6.2-1+deb12u2 busybox 1:1.35.0-4+deb12u1+b1 chrony 4.3-2+deb12u3 clamav-base 1.4.3+dfsg-1~deb12u2 clamav-daemon 1.4.3+dfsg-1~deb12u2 clamav-freshclam 1.4.3+dfsg-1~deb12u2 clamdscan 1.4.3+dfsg-1~deb12u2 dirmngr 2.2.40-1.1+deb12u2 distro-info-data 0.58+deb12u7 dpkg 1.21.23 gnupg 2.2.40-1.1+deb12u2 gnupg-l10n 2.2.40-1.1+deb12u2 gnupg-utils 2.2.40-1.1+deb12u2 gpg 2.2.40-1.1+deb12u2 gpg-agent 2.2.40-1.1+deb12u2 gpgconf 2.2.40-1.1+deb12u2 gpgsm 2.2.40-1.1+deb12u2 gpgv 2.2.40-1.1+deb12u2 gpg-wks-client 2.2.40-1.1+deb12u2 gpg-wks-server 2.2.40-1.1+deb12u2 grub2-common 2.06-13+deb12u2 grub-common 2.06-13+deb12u2 grub-pc 2.06-13+deb12u2 grub-pc-bin 2.06-13+deb12u2 intel-microcode 3.20251111.1~deb12u1 libbytes-random-secure-perl 0.29-4~deb13u1~deb12u1 libc6 2.36-9+deb12u14 libcap2 1:2.66-4+deb12u3+b1 libcap2-bin 1:2.66-4+deb12u3+b1 libc-bin 2.36-9+deb12u14 libc-l10n 2.36-9+deb12u14 libclamav12 1.4.3+dfsg-1~deb12u2 libcurl3-gnutls 7.88.1-10+deb12u15 libcurl4 7.88.1-10+deb12u15 libglib2.0-0 2.74.6-2+deb12u9 libgraphite2-3 1.3.14-1+deb12u1 libhtml-parser-perl 3.81-1+deb12u1 libnss-myhostname 252.39-1~deb12u2 libnss-resolve 252.39-1~deb12u2 libnss-systemd 252.39-1~deb12u2 libpam0g 1.5.2-6+deb12u2 libpam-modules 1.5.2-6+deb12u2 libpam-modules-bin 1.5.2-6+deb12u2 libpam-runtime 1.5.2-6+deb12u2 libpython3.11 3.11.2-6+deb12u8 libpython3.11-minimal 3.11.2-6+deb12u8 libpython3.11-stdlib 3.11.2-6+deb12u8 libsystemd0 252.39-1~deb12u2 libsystemd-shared 252.39-1~deb12u2 libudev1 252.39-1~deb12u2 libxml2 2.9.14+dfsg-1.3~deb12u6 libxml-libxml-perl 2.0207+dfsg+really+2.0134-1+deb12u1 libxslt1.1 1.1.35-1+deb12u4 linux-image-6.12.95+deb12-amd64 6.12.95-1~bpo12+1 linux-image-amd64 6.12.95-1~bpo12+1 locales 2.36-9+deb12u14 login 1:4.13+dfsg1-1+deb12u2 openmediavault 7.7.24-7 openssh-client 1:9.2p1-2+deb12u10 openssh-server 1:9.2p1-2+deb12u10 openssh-sftp-server 1:9.2p1-2+deb12u10 passwd 1:4.13+dfsg1-1+deb12u2 python3.11 3.11.2-6+deb12u8 python3.11-minimal 3.11.2-6+deb12u8 python3-xmltodict 0.13.0-1.1~deb12u1 rsync 3.2.7-1+deb12u6 sed 4.9-1+deb12u1 sudo 1.9.13p3-1+deb12u4 systemd 252.39-1~deb12u2 systemd-resolved 252.39-1~deb12u2 systemd-sysv 252.39-1~deb12u2 udev 252.39-1~deb12u2 wireless-regdb 2026.05.30-1~deb12u1 ======================================================================== Package Details: apt-listchanges: Leyendo lista de cambios... apt-listchanges: Changelogs --------------------------- --- Cambios de busybox --- busybox (1:1.35.0-4+deb12u1) bookworm; urgency=high * Non-maintainer upload by the LTS Team. * Import/Backport patches for: - CVE-2022-48174 - stack overflow (Closes: #1059049) - CVE-2023-42363 - use-after-free (Closes: #1059050) - CVE-2023-42364 - use-after-free (Closes: #1059051) This patch also covers CVE-2023-42365 (Closes: #1059052) -- Tobias Frost Mon, 02 Mar 2026 07:59:41 +0100 --- Cambios de gnupg2 (dirmngr gnupg gnupg-l10n gnupg-utils gpg gpg-agent gpgconf gpgsm gpgv gpg-wks-client gpg-wks-server) --- gnupg2 (2.2.40-1.1+deb12u2) bookworm; urgency=high * Address four issues from https://gpg.fail, including: + Fix CVE-2025-68973 (Closes: #1124221) + Avoid potential downgrade to SHA1 in 3rd party key signatures. + Error out on unverified output for non-detached signatures. + Do not use a default when asking for another output filename. * d/control: Point Vcs-Git to the correct branch -- Daniel Kahn Gillmor Thu, 01 Jan 2026 15:54:00 +0100 --- Cambios de intel-microcode --- intel-microcode (3.20251111.1~deb12u1) bookworm; urgency=medium * Backport to bookworm * debian/rules: revert use of /usr/lib/firmware for deb12 -- Henrique de Moraes Holschuh Sat, 22 Nov 2025 22:51:21 -0300 intel-microcode (3.20251111.1) unstable; urgency=high * New upstream microcode datafile 20251111 (closes: #1120589) - Fixes for unspecified functional issues on several Intel, Intel Core and Intel Xeon processor models. - Fixes errata RPL070/ADL083/LNL047/ALR054/SPR154/EMR147: REP SCASB, REP CMPSB may return incorrect results when racing memory access with another core or thread, on Raptor Lake, Arrow Lake, Lunar Lake, 4th/5th gen Xeon Scalable and maybe other processor models * New microcodes: + sig 0x000a06e1, pf_mask 0x97, 2025-06-27, rev 0x1000273, size 1635328 * Updated microcodes: + sig 0x000806f8, pf_mask 0x87, 2025-05-29, rev 0x2b000650, size 593920 + sig 0x000806f7, pf_mask 0x87, 2025-05-29, rev 0x2b000650 + sig 0x000806f6, pf_mask 0x87, 2025-05-29, rev 0x2b000650 + sig 0x000806f5, pf_mask 0x87, 2025-05-29, rev 0x2b000650 + sig 0x000806f4, pf_mask 0x87, 2025-05-29, rev 0x2b000650 + sig 0x000806f8, pf_mask 0x10, 2025-05-29, rev 0x2c000410, size 625664 + sig 0x000806f6, pf_mask 0x10, 2025-05-29, rev 0x2c000410 + sig 0x000806f5, pf_mask 0x10, 2025-05-29, rev 0x2c000410 + sig 0x000806f4, pf_mask 0x10, 2025-05-29, rev 0x2c000410 + sig 0x00090672, pf_mask 0x07, 2025-10-12, rev 0x003d, size 226304 + sig 0x00090675, pf_mask 0x07, 2025-10-12, rev 0x003d + sig 0x000b06f2, pf_mask 0x07, 2025-10-12, rev 0x003d + sig 0x000b06f5, pf_mask 0x07, 2025-10-12, rev 0x003d + sig 0x000b06f6, pf_mask 0x07, 2025-10-12, rev 0x003d + sig 0x000b06f7, pf_mask 0x07, 2025-10-12, rev 0x003d + sig 0x000906a3, pf_mask 0x80, 2025-10-12, rev 0x043a, size 224256 + sig 0x000906a4, pf_mask 0x80, 2025-10-12, rev 0x043a + sig 0x000906a4, pf_mask 0x40, 2025-06-13, rev 0x000b, size 119808 + sig 0x000a06d1, pf_mask 0x95, 2025-07-23, rev 0x10003f0, size 1670144 + sig 0x000a06d1, pf_mask 0x20, 2025-08-29, rev 0xa000124, size 1642496 + sig 0x000a06f3, pf_mask 0x01, 2025-07-30, rev 0x3000382, size 1534976 + sig 0x000b0671, pf_mask 0x32, 2025-10-08, rev 0x0132, size 219136 + sig 0x000b0674, pf_mask 0x32, 2025-10-08, rev 0x0132 + sig 0x000b06a2, pf_mask 0xe0, 2025-10-08, rev 0x6133, size 224256 + sig 0x000b06a3, pf_mask 0xe0, 2025-10-08, rev 0x6133 + sig 0x000b06a8, pf_mask 0xe0, 2025-10-08, rev 0x6133 + sig 0x000b06d1, pf_mask 0x80, 2025-08-28, rev 0x0125, size 80896 + sig 0x000b06e0, pf_mask 0x19, 2025-05-16, rev 0x001e, size 139264 + sig 0x000c0662, pf_mask 0x82, 2025-06-30, rev 0x011a, size 90112 + sig 0x000c06a2, pf_mask 0x82, 2025-06-30, rev 0x011a + sig 0x000c0652, pf_mask 0x82, 2025-06-30, rev 0x011a + sig 0x000c0664, pf_mask 0x82, 2025-06-30, rev 0x011a + sig 0x000c06f2, pf_mask 0x87, 2025-05-29, rev 0x210002c0, size 564224 + sig 0x000c06f1, pf_mask 0x87, 2025-05-29, rev 0x210002c0 * source: update symlinks to reflect id of the latest release, 20251111 -- Henrique de Moraes Holschuh Thu, 13 Nov 2025 12:48:02 -0300 --- Cambios de libxml2 --- libxml2 (2.9.14+dfsg-1.3~deb12u6) bookworm; urgency=high * Non-maintainer upload. * Fix CVE-2026-0989: Specially crafted or overly complex schemas can cause excessive recursion during parsing, which may lead to stack exhaustion and application crashes. The parser now enforces a limit on inclusion depth when resolving nested `` directives; the limit defaults to 1000 and can be modified at runtime with the env variable `RNG_INCLUDE_LIMIT`. (Closes: #1125691) * Fix CVE-2026-0990: `xmlCatalogXMLResolveURI()` will recurse infinitely if a catalog has a URI delegate referencing itself, eventually resulting in a call stack overflow. (Closes: #1125695) * Fix CVE-2026-0992: Denial of Service vulnerability due to uncontrolled resource consumption when processing XML catalogs containing repeated `` elements pointing to the same downstream catalog. (Closes: #1125696) * Fix CVE-2025-8732: When a catalog file contains a CATALOG directive pointing to itself, `xmlExpandCatalog()` and `xmlParseSGMLCatalog()` recursively call each other without bounds until stack overflow. * Fix CVE-2026-1757: Memory leak issue in the command parsing logic of the xmllint interactive shell. * Fix unit tests for CVE-2025-49794 and -49796. * Backport some more upstream changes from v2.15.2: + Fix memory leak of prefix in `xmlTextWriterStartElementNS()`. + Mitigate use-after-free issue in `xmlRelaxNGValidateValue()`. + Fix memory leak in `xmlTextWriterStartAttributeNS()`. + Schematron: Fix additional memory leaks on error paths. + Catalog: Fix stack overflow from self-referencing SGML CATALOG entries. -- Guilhem Moulin Sun, 07 Jun 2026 17:53:53 +0200 libxml2 (2.9.14+dfsg-1.3~deb12u5) bookworm; urgency=high * Non-maintainer upload. * Fix CVE-2025-9714: Denial of service vulnerability via uncontrolled recursion in XPath evaluation. * Amend d/p/CVE-2025-7425.patch to better reflect the original fix. -- Guilhem Moulin Sat, 11 Oct 2025 14:41:17 +0200 --- Cambios de linux-signed-amd64 (linux-image-6.12.95+deb12-amd64 linux-image-amd64) --- linux-signed-amd64 (6.12.95+1~bpo12+1) bookworm-backports; urgency=medium * Sign kernel from linux 6.12.95-1~bpo12+1 * Rebuild for bookworm-backports -- Ben Hutchings Sun, 05 Jul 2026 20:26:27 +0200 linux (6.12.95-1) trixie-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.95 - wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain - wifi: mt76: mt7921: fix a potential scan no APs - wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (CVE-2026-53101) - fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios (CVE-2026-53167) - gpiolib: Extract gpiochip_choose_fwnode() for wider use - gpiolib: Remove redundant assignment of return variable - gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() (CVE-2026-31732) - io_uring/net: Avoid msghdr on op_connect/op_bind async data - drm/xe/display: fix oops in suspend/shutdown without display (CVE-2026-53142) - [arm64] drm/v3d: Store the active job inside the queue's state - [arm64] drm/v3d: Skip CSD when it has zeroed workgroups (CVE-2026-53139) - eventpoll: use hlist_is_singular_node() in __ep_remove() - eventpoll: split __ep_remove() - eventpoll: kill __ep_remove() - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - eventpoll: rename ep_remove_safe() back to ep_remove() - eventpoll: move epi_fget() up - eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) - iio: light: bh1780: fix PM runtime leak on error path (CVE-2026-43355) - net: Drop the lock in skb_may_tx_timestamp() (CVE-2026-43216) - Reapply "selftest/ptp: update ptp selftest to exercise the gettimex options" - debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING - debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP - debugobjects: Do not fill_pool() if pi_blocked_on - debugobjects: Dont call fill_pool() in early boot hardirq context - RDMA/bnxt_re: zero shared page before exposing to userspace - i2c: stub: Reject I2C block transfers with invalid length - [amd64] agp/amd64: Fix broken error propagation in agp_amd64_probe() (CVE-2026-53325) - bpf: Reject sleepable kprobe_multi programs at attach time (CVE-2026-43010) - ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() - regulator: core: fix locking in regulator_resolve_supply() error path - dlm: prevent NPD when writing a positive value to event_done (CVE-2025-23131) - xfs: remove the expr argument to XFS_TEST_ERROR - xfs: fix error returns in CoW fork repair - Revert "net: bonding: fix use-after-free in bond_xmit_broadcast()" - net: bonding: add broadcast_neighbor option for 802.3ad - bonding: add support for per-port LACP actor priority - bonding: print churn state via netlink - bonding: 3ad: implement proper RCU rules for port->aggregator (CVE-2026-52975) - net: bonding: fix use-after-free in bond_xmit_broadcast() (CVE-2026-31419) - bonding: fix NULL pointer dereference in actor_port_prio setting - staging: rtl8723bs: fix buffer over-read in rtw_update_protection (CVE-2026-53179) - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341) - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs - hv: utils: handle and propagate errors in kvp_register - locking/mutex: Remove wakeups from under mutex::wait_lock - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued - phonet: Pass ifindex to fill_addr(). - phonet: Pass net and ifindex to phonet_address_notify(). - net: phonet: free phonet_device after RCU grace period (CVE-2026-53157) - rxrpc: Fix the ACK parser to extract the SACK table for parsing (CVE-2026-53151) - fuse: re-lock request before replacing page cache folio - ftrace: Update the mcount_loc check of skipped entries - ftrace: Have ftrace pages output reflect freed pages - ftrace: Do not over-allocate ftrace memory - ftrace: Test mcount_loc addr before calling ftrace_call_addr() - ftrace: Check against is_kernel_text() instead of kaslr_offset() - net: ipv6: Make udp_tunnel6_xmit_skb() void - sctp: disable BH before calling udp_tunnel_xmit_skb() (CVE-2026-53070) - iio: light: veml6075: add bounds check to veml6075_it_ms index - iio: adc: ti-ads1298: add bounds check to pga_settings index - vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write - [arm64] serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero - ksmbd: reject non-VALID session in compound request branch - media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si - virtiofs: fix UAF on submount umount - [amd64] KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359) - [amd64] KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level - Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support" - [amd64] KVM: SEV: Ignore MMIO requests of length '0' - [amd64] KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ - [amd64] KVM: SEV: Ignore Port I/O requests of length '0' - batman-adv: tp_meter: keep unacked list in ascending ordered - batman-adv: tp_meter: initialize dup_acks explicitly - batman-adv: tp_meter: initialize dec_cwnd explicitly - batman-adv: tp_meter: avoid window underflow - batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd - batman-adv: tp_meter: fix fast recovery precondition - batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection - batman-adv: tp_meter: add only finished tp_vars to lists - batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE - batman-adv: prevent ELP transmission interval underflow - batman-adv: tp_meter: initialize last_recv_time during init - batman-adv: ensure bcast is writable before modifying TTL - batman-adv: fix (m|b)cast csum after decrementing TTL - batman-adv: frag: ensure fragment is writable before modifying TTL - batman-adv: frag: avoid underflow of TTL - batman-adv: v: prevent OGM aggregation on disabled hardif - batman-adv: tp_meter: restrict number of unacked list entries - batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE - batman-adv: tp_meter: prevent parallel modifications of last_recv - batman-adv: tp_meter: handle overlapping packets - batman-adv: tt: don't merge change entries with different VIDs - batman-adv: tt: track roam count per VID - batman-adv: dat: prevent false sharing between VLANs - batman-adv: tvlv: enforce 2-byte alignment - batman-adv: tvlv: avoid race of cifsnotfound handler state - ipv6: account for fraggap on the paged allocation path (CVE-2026-53362) - fs: constify file ptr in backing_file accessor helpers - lsm: add backing_file LSM hooks - selinux: fix overlayfs mmap() and mprotect() access checks - inet: add indirect call wrapper for getfrag() calls - ipv4: account for fraggap on the paged allocation path - ntfs3: reject direct userspace writes to reserved $LX* xattrs - [amd64] KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb() - [amd64] KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free - af_unix: Set gc_in_progress to true in unix_gc(). (CVE-2026-53361) - mtd: spi-nor: macronix: Add post_sfdp fixups for Quad Input Page Program - mtd: spi-nor: macronix: add support for mx66{l2, u1}g45g - mac802154: llsec: add skb_cow_data() before in-place crypto - net: skmsg: preserve sg.copy across SG transforms - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink - apparmor: mediate the implicit connect of TCP fast open sendmsg - apparmor: fix use-after-free in rawdata dedup loop - NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR - fbdev: fix use-after-free in store_modes() - kernel/fork: clear PF_BLOCK_TS in copy_process() - block: invalidate cached plug timestamp after task switch - err.h: use __always_inline on all error pointer helpers - KEYS: fix overflow in keyctl_pkey_params_get_2() - keys: Pin request_key_auth payload in instantiate paths - wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S - wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer - wifi: ath11k: fix warning when unbinding - wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor - wifi: rtw88: increase TX report timeout to fix race condition - wifi: rtw88: usb: fix memory leaks on USB write failures - wifi: iwlwifi: mvm: fix race condition in PTP removal - f2fs: validate compress cache inode only when enabled - f2fs: fix to round down start offset of fallocate for pin file - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() - f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() - f2fs: keep atomic write retry from zeroing original data - block: Avoid mounting the bdev pseudo-filesystem in userspace - bpf: use kvfree() for replaced sysctl write buffer - exfat: fix potential use-after-free in exfat_find_dir_entry() - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() - gfs2: fix use-after-free in gfs2_qd_dealloc - [arm64] pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() - hdlc_ppp: sync per-proto timers before freeing hdlc state - blk-cgroup: fix UAF in __blkcg_rstat_flush() - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done - pNFS: Fix use-after-free in pnfs_update_layout() - fpga: region: fix use-after-free in child_regions_with_firmware() - rpmsg: char: Fix use-after-free on probe error path - ocfs2: reject oversized group bitmap descriptors - 9p: avoid putting oldfid in p9_client_walk() error path - [amd64] KVM: x86: hyper-v: Bound the bank index when querying sparse banks - [amd64] KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path - power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() - [riscv64] mm: Extract helper mark_new_valid_map() - [riscv64] kfence: Call mark_new_valid_map() for kfence_unprotect() - fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var - fbdev: modedb: fix a possible UAF in fb_find_mode() - fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode - i2c: core: fix adapter registration race - NFSD: Fix SECINFO_NO_NAME decode error cleanup - nfsd: fix posix_acl leak on SETACL decode failure - nfsd: check get_user() return when reading princhashlen - nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race - nfsd: reset write verifier on deferred writeback errors - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr - NFS: Prevent resource leak in nfs_alloc_server() - ksmbd: fix out-of-bounds read in smb_check_perm_dacl() - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails - drivers/base/memory: set mem->altmap after successful device registration - Documentation: ioctl-number: Fix linuxppc-dev mailto link - Documentation: ioctl-number: Extend "Include File" column width - [amd64] crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() - [amd64] crypto: qat - Return pointer directly in adf_ctl_alloc_resources - [amd64] crypto: qat - remove unused character device and IOCTLs - net/tcp-ao: fix use-after-free of key in del_async path - locking: rtmutex: Fix wake_q logic in task_blocks_on_rt_mutex - net: bonding: update the slave array for broadcast mode - bonding: annotate data-races arcound churn variables - bonding: do not set usable_slaves for broadcast mode [ Salvatore Bonaccorso ] * net/netfilter: Enable NETFILTER_NETLINK_HOOK as module (Closes: #1139686) * [rt] Refresh "locking/rt: Annotate unlock followed by lock for sparse." [ Uwe Kleine-König ] * [amd64] Enable CONFIG_PINCTRL_CS42L43 and CONFIG_SPI_CS42L43 explicitly (Closes: #1136179) -- Salvatore Bonaccorso Sat, 04 Jul 2026 20:24:27 +0200 linux (6.12.94-1~bpo12+1) bookworm-backports; urgency=medium * Rebuild for bookworm-backports -- Ben Hutchings Sun, 21 Jun 2026 22:18:31 +0200 linux (6.12.94-1) trixie-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.91 - io_uring/kbuf: use mem_is_zero() - blk-cgroup: wait for blkcg cleanup before initializing new disk - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START - fs/mbcache: cancel shrink work before destroying the cache - md/raid1: fix the comparing region of interval tree - drbd: Balance RCU calls in drbd_adm_dump_devices() - loop: fix partition scan race between udev and loop_reread_partitions() - nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty() - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() - pstore/ram: fix resource leak when ioremap() fails - md: wake raid456 reshape waiters before suspend - btrfs: pass struct btrfs_inode to clone_copy_inline_extent() - btrfs: fix deadlock between reflink and transaction commit when using flushoncommit - [amd64] ACPI: x86: cmos_rtc: Clean up address space handler driver - [amd64] ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver - devres: fix missing node debug info in devm_krealloc() - thermal/drivers/spear: Fix error condition for reading st,thermal-flags - debugfs: check for NULL pointer in debugfs_create_str() - debugfs: fix placement of EXPORT_SYMBOL_GPL for debugfs_create_str() - soundwire: debugfs: initialize firmware_file to empty string - PCI: use generic driver_override infrastructure - platform/wmi: use generic driver_override infrastructure - [s390x] cio: use generic driver_override infrastructure - bus: fsl-mc: use generic driver_override infrastructure - irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter - hrtimers: Update the return type of enqueue_hrtimer() - hrtimer: Avoid pointless reprogramming in __hrtimer_start_range_ns() - hrtimer: Reduce trace noise in hrtimer_start() - locking: Fix rwlock support in - firmware: dmi: Correct an indexing error in dmi.h - wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet - bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap - dpaa2: add independent dependencies for FSL_DPAA2_SWITCH - dpaa2: compile dpaa2 even CONFIG_FSL_DPAA2_ETH=n - [s390x] bpf: Zero-extend bpf prog return values and kfunc arguments - params: Replace __modinit with __init_or_module - module: Fix freeing of charp module parameters when CONFIG_SYSFS=n - wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() - wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control - wifi: mt76: mt7615: fix use_cts_prot support - wifi: mt76: mt7915: fix use_cts_prot support - wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() - wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi - wifi: mt76: mt7996: fix FCS error flag check in RX descriptor - wifi: mt76: mt7921: Place upper limit on station AID - [arm64] cpufeature: Make PMUVer and PerfMon unsigned - wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event - wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() - wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() - wifi: mt76: mt7921: fix 6GHz regulatory update on connection - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path - bpf: Fix variable length stack write over spilled pointers - bpf,arc_jit: Fix missing newline in pr_err messages - wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() - r8152: fix incorrect register write to USB_UPHY_XTAL - [powerpc*] crash: fix backup region offset update to elfcorehdr - [powerpc*] crash: Update backup region offset in elfcorehdr on memory hotplug - macvlan: annotate data-races around port->bc_queue_len_used - bpf: fix end-of-list detection in cgroup_storage_get_next_key() - bpf: Fix stale offload->prog pointer after constant blinding - wifi: brcmfmac: Fix error pointer dereference - wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() - bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() - wifi: ath10k: fix station lookup failure during disconnect - ACPI: AGDI: fix missing newline in error message - [arm64] kexec: Remove duplicate allocation for trans_pgd - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb - net: bcmgenet: add bcmgenet_has_* helpers - net: bcmgenet: move DESC_INDEX flow to ring 0 - net: bcmgenet: support reclaiming unsent Tx packets - net: bcmgenet: switch to use 64bit statistics - net: bcmgenet: fix racing timeout handler - eth: fbnic: Use wake instead of start - netfilter: xt_socket: enable defrag after all other checks - netfilter: nft_fwd_netdev: check ttl/hl before forwarding - bpf: fix mm lifecycle in open-coded task_vma iterator - bpf: switch task_vma iterator from mmap_lock to per-VMA locks - bpf: return VMA snapshot from task_vma iterator - bpf: Fix RCU stall in bpf_fd_array_map_clear() - net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf - bpf: Relax scalar id equivalence for state pruning - bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars - net/sched: act_ct: Only release RCU read lock after ct_ft - net: airoha: Implement BQL support - net: airoha: Add missing RX_CPU_IDX() configuration in airoha_qdma_cleanup_rx_queue() - bpf: Allow instructions with arena source and non-arena dest registers - net/rds: Optimize rds_ib_laddr_check - net/rds: Restrict use of RDS/IB to the initial network namespace - bpf: Fix OOB in pcpu_init_value - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls - net: ipa: Fix programming of QTIME_TIMESTAMP_CFG - net: ipa: Fix decoding EV_PER_EE for IPA v5.0+ - dt-bindings: net: dsa: nxp,sja1105: make spi-cpol optional for sja1110 - net: phy: fix a return path in get_phy_c45_ids() - net/mlx5e: Fix features not applied during netdev registration - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() - bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb - Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp - Bluetooth: SCO: check for codecs->num_codecs == 1 before assigning to sco_pi(sk)->codec - net: phy: qcom: at803x: Use the correct bit to disable extended next page - ipv4: udp: fix typos in comments - ipv6: udp: fix typos in comments - udp: Force compute_score to always inline - tcp: Don't set treq->req_usec_ts in cookie_tcp_reqsk_init(). - sctp: fix missing encap_port propagation for GSO fragments - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master - drm/komeda: fix integer overflow in AFBC framebuffer size check - ASoC: SOF: ipc3: Use standard dev_dbg API - ASoC: add symmetric_ prefix for dai->rate/channels/sample_bits - ASoC: soc-compress: use function to clear symmetric params - drm/sun4i: backend: fix error pointer dereference - ASoC: sti: Return errors from regmap_field_alloc() - ASoC: sti: use managed regmap_field allocations - dm cache: fix null-deref with concurrent writes in passthrough mode - dm cache: fix write path cache coherency in passthrough mode - dm cache: fix write hang in passthrough mode - dm cache policy smq: fix missing locks in invalidating cache blocks - dm cache: fix concurrent write failure in passthrough mode - dm cache: support shrinking the origin device - dm cache: fix dirty mapping checking in passthrough mode switching - platform/chrome: chromeos_tbmc: Drop wakeup source on remove - PCI: endpoint: Align pci_epc_set_msix(), pci_epc_ops::set_msix() nr_irqs encoding - PCI: dwc: ep: Fix MSI-X Table Size configuration in dw_pcie_ep_set_msix() - PCI: dwc: Invoke post_init in dw_pcie_resume_noirq() - PCI: dwc: Perform cleanup in the error path of dw_pcie_resume_noirq() - dm cache metadata: fix memory leak on metadata abort retry - dm log: fix out-of-bounds write due to region_count overflow - drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() - drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs - drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check - spi: spi-nxp-fspi: enable runtime pm for fspi - spi: nxp-fspi: Use reinit_completion() for repeated operations - spi: fsl-qspi: Use reinit_completion() for repeated operations - media: i2c: og01a1b: Replace client->dev usage - media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe - drm/v3d: Handle error from drm_sched_entity_init() - drm/sun4i: Fix resource leaks - drm/amdgpu: Add default case in DVI mode validation - dm init: ensure device probing has finished in dm-mod.waitfor= - fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break - crypto: tegra - finalize crypto req on error - crypto: tegra - Transfer HASH init function to crypto engine - crypto: tegra - Reserve keyslots to allocate dynamically - crypto: tegra - Disable softirqs before finalizing request - crypto: atmel - Use unregister_{aeads,ahashes,skciphers} - crypto: atmel-aes - guard unregister on error in atmel_aes_register_algs - padata: Remove cpu online check from cpu add and removal - padata: Put CPU offline callback in ONLINE section to allow failure - PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation - drm/amdgpu/gfx10: look at the right prop for gfx queue priority - drm/amdgpu/gfx11: look at the right prop for gfx queue priority - spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo - drm/imagination: Switch reset_reason fields from enum to u32 - iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init() - [arm64] drm/msm/dpu: fix mismatch between power and frequency - [arm64] drm/msm/dsi: add the missing parameter description - [arm64] drm/msm/dsi: fix bits_per_pclk - [arm64] drm/msm/dsi: fix hdisplay calculation for CMD mode panel - [arm64] drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 - drm/panel: sharp-ls043t1le01: make use of prepare_prev_first - drm/panel: simple: Correct G190EAN01 prepare timing - PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support - ALSA: core: Validate compress device numbers without dynamic minors - drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled - drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs - drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock - drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 - drm/amd/pm/ci: Clear EnabledForActivity field for memory levels - drm/amd/pm/ci: Fill DW8 fields from SMC - drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board - drm/amdgpu: add amdgpu_device reference in ip block - drm/amdgpu: update the handle ptr in dump_ip_state - drm/amdgpu: update the handle ptr in early_init - drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled - hwmon: Switch back to struct platform_driver::remove() - hwmon: (aspeed-g6-pwm-tach): remove redundant driver remove callback - ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') - [amd64] ASoC: SOF: Intel: hda: Place check before dereference - [arm64] drm/msm/a6xx: Fix HLSQ register dumping - [arm64] drm/msm/shrinker: Fix can_block() logic - [arm64] drm/msm/a6xx: Fix dumping A650+ debugbus blocks - [arm64] drm/msm/a6xx: Use barriers while updating HFI Q headers - pmdomain: ti: omap_prm: Fix a reference leak on device node - pmdomain: imx: scu-pd: Fix device_node reference leak during ->probe() - PM: domains: De-constify fields in struct dev_pm_domain_attach_data - ASoC: fsl_micfil: Add access property for "VAD Detected" - ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() - ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() - ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() - ASoC: fsl_micfil: Fix event generation in micfil_quality_set() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() - ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() - ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() - ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() - ASoC: fsl_easrc: Change the type for iec958 channel status controls - [amd64] iommu/amd: Remove protection_domain.dev_cnt variable - [amd64] iommu/amd: xarray to track protection_domain->iommu list - [amd64] iommu/amd: Do not detach devices in domain free path - [amd64] iommu/amd: Reduce domain lock scope in attach device path - [amd64] iommu/amd: Rearrange attach device code - [amd64] iommu/amd: Convert dev_data lock from spinlock to mutex - [amd64] iommu/amd: Introduce helper function to update 256-bit DTE - [amd64] iommu/amd: Introduce helper function get_dte256() - [amd64] iommu/amd: Fix clone_alias() to use the original device's devid - [arm64] ASoC: qcom: qdsp6: topology: check widget type before accessing data - crypto: qat - introduce fuse array - crypto: qat - disable 4xxx AE cluster when lead engine is fused off - crypto: qat - disable 420xx AE cluster when lead engine is fused off - crypto: qat - fix type mismatch in RAS sysfs show functions - crypto: qat - use swab32 macro - ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] - PCI: Enable AtomicOps only if Root Port supports them - PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found - Documentation: fix a hugetlbfs reservation statement - ALSA: scarlett2: Add missing sentinel initializer field - ASoC: SOF: compress: return the configured codec from get_params - PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports - PCI: tegra194: Fix polling delay for L2 state - PCI: tegra194: Increase LTSSM poll time on surprise link down - PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down - PCI: tegra194: Rename 'root_bus' to 'root_port_bus' in tegra_pcie_downstream_dev_to_D0() - PCI: tegra194: Don't force the device into the D0 state before L2 - PCI: tegra194: Disable PERST# IRQ only in Endpoint mode - PCI: tegra194: Use devm_gpiod_get_optional() to parse "nvidia,refclk-select" - PCI: tegra194: Disable direct speed change for Endpoint mode - PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode - PCI: tegra194: Allow system suspend when the Endpoint link is not up - PCI: tegra194: Free up Endpoint resources during remove() - PCI: tegra194: Use DWC IP core version - PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well - PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on - spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback - ALSA: sc6000: Keep the programmed board state in card-private data - dm cache: fix missing return in invalidate_committed's error path - crypto: jitterentropy - replace long-held spinlock with mutex - ALSA: hda/realtek - fixed speaker no sound update - gfs2: Call unlock_new_inode before d_instantiate - net/socket.c: switch to CLASS(fd) - fdget(), trivial conversions - fanotify: call fanotify_events_supported() before path_permission() and security_path_notify() - quota: Fix race of dquot_scan_active() with quota deactivation - gfs2: add some missing log locking - gfs2: prevent NULL pointer dereference during unmount - efi/capsule-loader: fix incorrect sizeof in phys array reallocation - ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine - [arm64] dts: mediatek: mt8365: Describe infracfg-nao as a pure syscon - memory: tegra124-emc: Fix dll_change check - memory: tegra30-emc: Fix dll_change check - [arm64] dts: imx8-apalis: Fix LEDs name collision - [arm64] dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config - [arm64] dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 W_DISABLE1) - iommufd: vfio compatibility extension check for noiommu mode - [arm64] dts: mediatek: mt6795: Fix gpio-ranges pin count - [arm64] dts: mediatek: mt7981b: Fix gpio-ranges pin count - [arm64] dts: mediatek: mt7986a: Fix gpio-ranges pin count - [arm64] dts: qcom: msm8953-xiaomi-vince: correct wled ovp value - [arm64] dts: qcom: msm8953-xiaomi-daisy: fix backlight - [arm64] dts: rockchip: Fix Bluetooth stability on LCKFB TaiShan Pi - [arm64] dts: rockchip: Correct Fan Supply for Gameforce Ace - [arm64] dts: rockchip: Correct Joystick Axes on Gameforce Ace - [arm64] soc: qcom: ocmem: make the core clock optional - [arm64] soc: qcom: ocmem: register reasons for probe deferrals - [arm64] soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available - bus: rifsc: fix RIF configuration check for peripherals - [arm64] dts: qcom: sm8450: Fix GIC_ITS range length - [arm64] dts: qcom: sm8550: Fix GIC_ITS range length - [arm64] dts: qcom: sm8650: Fix GIC_ITS range length - [arm64] dts: qcom: sm8550: Fix xo clock supply of platform SD host controller - [arm64] dts: qcom: sm8650: Fix xo clock supply of SD host controller - [arm64] dts: qcom: sm8450: Enable UHS-I SDR50 and SDR104 SD card modes - [arm64] dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes - [arm64] dts: qcom: sm8650: Enable UHS-I SDR50 and SDR104 SD card modes - [arm64] dts: qcom: sm7225-fairphone-fp4: Fix conflicting bias pinctrl - [arm64] dts: qcom: sdm845-xiaomi-beryllium: Mark l1a regulator as powered during boot - [arm64] dts: ti: k3-am62p5-sk: Disable MMC1 internal pulls on data pins - [arm64] dts: ti: k3-am62-lp-sk: Enable internal pulls for MMC0 data pins - [arm64] dts: ti: k3-am62-verdin: Fix SPI_1 GPIO CS pinctrl label - [arm64] dts: freescale: imx8mp-tqma8mpql-mba8mp-ras314: fix UART1 RTS/CTS muxing - [arm64] dts: lx2160a: change i2c0 (iic1) pinmux mask to one bit - [arm64] dts: lx2160a: remove duplicate pinmux nodes - [arm64] dts: lx2160a: rename pinmux nodes for readability - [arm64] dts: lx2160a: add sda gpio references for i2c bus recovery - [arm64] dts: lx2160a: change zeros to hexadecimal in pinmux nodes - [arm64] dts: lx2160a: complete pinmux for rcwsr12 configuration word - [arm64] dts: imx8qm-mek: switch Type-C connector power-role to dual - [arm64] dts: imx8qxp-mek: switch Type-C connector power-role to dual - soc/tegra: cbb: Set ERD on resume for err interrupt - unshare: fix nsproxy leak in ksys_unshare() on set_cred_ucounts() failure - ocfs2/dlm: validate qr_numregions in dlm_match_regions() - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison - soc: qcom: llcc: fix v1 SB syndrome register offset - [arm64] soc: qcom: aoss: compare against normalized cooling state - [arm64] dts: qcom: sm8250: Add missing CPU7 3.09GHz OPP - [arm64] xor: fix conflicting attributes for xor_block_template - firmware: arm_ffa: Use the correct buffer size during RXTX_MAP - ocfs2: fix listxattr handling when the buffer is full - ocfs2: validate bg_bits during freefrag scan - ocfs2: validate group add input before caching - dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function - soundwire: bus: demote UNATTACHED state warnings to dev_dbg() - dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() - soundwire: cadence: Clear message complete before signaling waiting thread - tracing: Rebuild full_name on each hist_field_name() call - hte: tegra194: remove Kconfig dependency on Tegra194 SoC - remoteproc: xlnx: Fix sram property parsing - ima: check return value of crypto_shash_final() in boot aggregate - HID: asus: make asus_resume adhere to linux kernel coding standards - HID: asus: do not abort probe when not necessary - mtd: physmap_of_gemini: Fix disabled pinctrl state check - ima_fs: don't bother with removal of files in directory we'll be removing - ima_fs: get rid of lookup-by-dentry stuff - ima_fs: Correctly create securityfs files for unsupported hash algos - dt-bindings: interrupt-controller: arm,gic-v3: Fix EPPI range - mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations - mtd: spi-nor: sfdp: introduce smpt_read_dummy fixup hook - mtd: spi-nor: sfdp: introduce smpt_map_id fixup hook - mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation - mtd: spi-nor: swp: check SR_TB flag when getting tb_mask - mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path - mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions - cxl/pci: Check memdev driver binding status in cxl_reset_done() - mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob - HID: usbhid: fix deadlock in hid_post_reset() - ext4: fix possible null-ptr-deref in mbt_kunit_exit() - [arm64] bpf, arm64: Fix off-by-one in check_imm signed range check - bpf, sockmap: Fix af_unix iter deadlock - bpf, sockmap: Fix af_unix null-ptr-deref in proto update - bpf, sockmap: Take state lock for af_unix iter - bpf: Fix precedence bug in convert_bpf_ld_abs alignment check - bpf: Fix NULL deref in map_kptr_match_type for scalar regs - bpf: allow UTF-8 literals in bpf_bprintf_prepare() - bpf: Validate node_id in arena_alloc_pages() - bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT - pinctrl: pinctrl-pic32: Fix resource leak - pinctrl: cy8c95x0: remove duplicate error message - pinctrl: cy8c95x0: Unify messages with help of dev_err_probe() - pinctrl: cy8c95x0: Avoid returning positive values to user space - perf branch: Avoid incrementing NULL - perf: tools: cs-etm: Fix print issue for Coresight debug in ETE/TRBE trace - pinctrl: realtek: Fix function signature for config argument - pinctrl: abx500: Fix type of 'argument' variable - pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers - perf lock: Fix option value type in parse_max_stack - perf stat: Fix opt->value type for parse_cache_level - perf tools: Fix module symbol resolution for non-zero .text sh_addr - perf expr: Return -EINVAL for syntax error in expr__find_ids() - ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure - ipmi: ssif_bmc: fix message desynchronization after truncated response - ipmi: ssif_bmc: change log level to dbg in irq callback - perf evsel: Add alternate_hw_config and use in evsel__match - perf tool_pmu: Factor tool events into their own PMU - perf python: Add parse_events function - perf cgroup: Update metric leader in evlist__expand_cgroup - perf maps: Fix copy_from that can break sorted by name order - perf util: Kill die() prototype, dead for a long time - reset: replace boolean parameters with flags parameter - reset: Add devres helpers to request pre-deasserted reset controls - i3c: master: dw-i3c: Fix missing reset assertion in remove() callback - i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() - i3c: mipi-i3c-hci: fix IBI payload length calculation for final status - backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() - platform/surface: surfacepro3_button: Drop wakeup source on remove - leds: lgm-sso: Remove duplicate assignments for priv->mmap - tty: hvc_iucv: fix off-by-one in number of supported devices - platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup - mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() - nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist() - [amd64] platform/x86: asus-wmi: adjust screenpad power/brightness handling - [amd64] platform/x86: asus-wmi: fix screenpad brightness range - tty: serial: ip22zilog: Fix section mispatch warning - fs/ntfs3: terminate the cached volume label after UTF-8 conversion - [amd64] platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() - [amd64] platform/x86: dell-wmi-sysman: bound enumeration string aggregation - RDMA/core: Prefer NLA_NUL_STRING - clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source - scsi: sg: Fix sysctl sg-big-buff register during sg_init() - scsi: sg: Resolve soft lockup issue when opening /dev/sgX - clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers - clk: qcom: dispcc-sm4450: Fix DSI byte clock rate setting - scsi: target: core: Fix integer overflow in UNMAP bounds check - dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs - clk: qcom: gcc-sc8180x: Add missing GDSCs - clk: qcom: gcc-sc8180x: Use retention for USB power domains - clk: qcom: gcc-sc8180x: Use retention for PCIe power domains - clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk - clk: qcom: dispcc-sm8250: Enable parents for pixel clocks - clk: imx: imx6q: Fix device node reference leak in pll6_bypassed() - clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels() - clk: imx8mq: Correct the CSI PHY sels - [amd64] x86/um/vdso: Drop VDSO64-y from Makefile - clk: qoriq: avoid format string warning - clk: xgene: Fix mapping leak in xgene_pllclk_init() - dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets - clk: qcom: dispcc-sc7180: Add missing MDSS resets - lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() - clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON - clk: visconti: pll: initialize clk_init_data to zero - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() - [amd64] drm/i915: Relocate the SKL wm sanitation code - [amd64] drm/i915/wm: Verify the correct plane DDB entry - crypto: sa2ul - Fix AEAD fallback algorithm names - crypto: ccp - copy IV using skcipher ivsize - erofs: add encoded extent on-disk definition - erofs: do sanity check on m->type in z_erofs_load_compact_lcluster() - erofs: avoid infinite loops due to corrupted subpage compact indexes (CVE-2025-68251) - erofs: unify lcn as u64 for 32-bit platforms - [arm64] dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT - [arm64] dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT - [arm64] dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT - [arm64] dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT - [arm64] dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT - [arm64] dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT - PCMCIA: Fix garbled log messages for KERN_CONT - [arm64] dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT - [arm64] dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT - [arm64] dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT - [arm64] dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's phy-names - net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF - net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys - nexthop: fix IPv6 route referencing IPv4 nexthop - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch - tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans - tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE - tcp: annotate data-races around tp->bytes_sent - tcp: annotate data-races around tp->bytes_retrans - tcp: annotate data-races around tp->dsack_dups - tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) - tcp: annotate data-races around tp->plb_rehash - ice: update PCS latency settings for E825 10G/25Gb modes - ice: Remove jumbo_remove step from TX path - ice: fix double-free of tx_buf skb - ice: fix ICE_AQ_LINK_SPEED_M for 200G - i40e: don't advertise IFF_SUPP_NOFCS - e1000e: Unroll PTP in probe error handling - ipv6: fix possible UAF in icmpv6_rcv() - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks - pppoe: drop PFC frames - net/mlx5: Fix HCA caps leak on notifier init failure - openvswitch: cap upcall PID array size and pre-size vport replies - netfilter: nft_osf: restrict it to ipv4 - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO - netfilter: conntrack: remove sprintf usage - netfilter: xtables: restrict several matches to inet family - ipvs: fix MTU check for GSO packets in tunnel mode - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check - slip: reject VJ receive packets on instances with no rstate array - slip: bound decode() reads against the compressed packet length - [arm64] dts: meson-gxl-p230: fix ethernet PHY interrupt number - pwm: atmel-tcb: Cache clock rates and mark chip as atomic - ksmbd: destroy tree_conn_ida in ksmbd_session_destroy() - ksmbd: destroy async_ida in ksmbd_conn_free() - ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open - ksmbd: scope conn->binding slowpath to bound sessions only - net/rds: zero per-item info buffer before handing it to visitors - ice: fix timestamp interrupt configuration for E825C - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g - net_sched: sch_hhf: annotate data-races in hhf_dump_stats() - net/sched: sch_pie: annotate data-races in pie_dump_stats() - net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats() - net/sched: sch_red: annotate data-races in red_dump_stats() - net/sched: sch_sfb: annotate data-races in sfb_dump_stats() - net: dsa: realtek: rtl8365mb: fix mode mask calculation - net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue() - virtio_net: Split struct virtio_net_rss_config - virtio_net: Fix endian with virtio_net_ctrl_rss - virtio_net: Use new RSS config structs - virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via VQ_PAIRS_SET - nfp: fix swapped arguments in nfp_encode_basic_qdr() calls - tipc: fix double-free in tipc_buf_append() - vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll() - fs/adfs: validate nzones in adfs_validate_bblk() - rtc: abx80x: Disable alarm feature if no interrupt attached - kbuild: builddeb - avoid recompiles for non-cross-compiles - fbdev: offb: fix PCI device reference leak on probe failure - mailbox: mtk-cmdq: Fix CURR and END addr for task insert case - mailbox: mailbox-test: free channels on probe error - cgroup/rdma: fix integer overflow in rdmacg_try_charge() - mailbox: add sanity check for channel array - mailbox: mailbox-test: don't free the reused channel - mailbox: mailbox-test: initialize struct earlier - mailbox: mailbox-test: make data_ready a per-instance variable - fsnotify: fix inode reference leak in fsnotify_recalc_mask() - btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent() - cgroup: Increment nr_dying_subsys_* from rmdir context - tracing: branch: Fix inverted check on stat tracer registration - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - netfilter: arp_tables: fix IEEE1394 ARP payload parsing - nvme-pci: fix missed admin queue sq doorbell write - drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM - drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG - drm/amdgpu: fix spelling typos - drm/amdgpu/uvd3.1: Don't validate the firmware when already validated - drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) - netfilter: xt_policy: fix strict mode inbound policy matching - netfilter: nf_conntrack_sip: don't use simple_strtoul - [amd64] ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED - spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ - drm/sysfb: ofdrm: fix PCI device reference leaks - arm64/scs: Fix potential sign extension issue of advance_loc4 - cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro() - netdevsim: zero initialize struct iphdr in dummy sk_buff - net/sched: netem: fix probability gaps in 4-state loss model - net/sched: netem: fix queue limit check to include reordered packets - net/sched: netem: only reseed PRNG when seed is explicitly provided - net/sched: netem: validate slot configuration - net/sched: netem: fix slot delay calculation overflow - net/sched: netem: check for negative latency and jitter - net/sched: sch_choke: annotate data-races in choke_dump_stats() - net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats() - vrf: Fix a potential NPD when removing a port from a VRF - net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() - net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit - NFC: trf7970a: Ignore antenna noise when checking for RF field - net/sched: taprio: fix NULL pointer dereference in class dump - neigh: let neigh_xmit take skb ownership - tcp: make probe0 timer handle expired user timeout - net, treewide: define and use MAC_ADDR_STR_LEN - netconsole: allow selection of egress interface via MAC address - netpoll: Extract carrier wait function - netpoll: extract IPv4 address retrieval into helper function - netpoll: fix IPv6 local-address corruption - ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams - sched/fair: Clear rel_deadline when initializing forked entities - net: mctp i2c: check length before marking flow active - net: phy: dp83869: fix setting CLK_O_SEL field. - drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring - drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring - drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring - ASoC: codecs: ab8500: Fix casting of private data - netfilter: skip recording stale or retransmitted INIT - sctp: discard stale INIT after handshake completion - bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() - net/sched: sch_cake: annotate data-races in cake_dump_stats() (V) - netconsole: propagate device name truncation in dev_name_store() - ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 - ALSA: hda/conexant: Fix missing error check for jack detection - ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi() - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup - drm/amd/display: Allow DCE link encoder without AUX registers - drm/amd/display: Read EDID from VBIOS embedded panel info - drm/xe/debugfs: Correct printing of register whitelist ranges - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() - drm/xe/gsc: Fix BO leak on error in query_compatibility_version() - page_pool: Set `dma_sync` to false for devmem memory provider - net: page_pool: create hooks for custom memory providers - page_pool: fix memory-provider leak in page_pool_create_percpu() error path - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - iavf: stop removing VLAN filters from PF on interface down - iavf: wait for PF confirmation before removing VLAN filters - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - ice: fix NULL pointer dereference in ice_reset_all_vfs() - net: tls: fix strparser anchor skb leak on offload RX setup failure - sfc: fix error code in efx_devlink_info_running_versions() - net/sched: cls_flower: revert unintended changes - [arm64] Reserve an extra page for early kernel mapping - smb: client: correctly handle ErrorContextData as a flexible array - smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613) - LoongArch: KVM: Compile switch.S directly into the kernel - ntfs: ->d_compare() must not block - PCI: Initialize temporary device in new_id_store() - net: bcmgenet: Initialize u64 stats seq counter - net: bcmgenet: fix leaking free_bds - [amd64] iommu/amd: Reorder attach device code - [amd64] iommu/amd: Put list_add/del(dev_data) back under the domain->lock - perf tool_pmu: Fix aggregation on duration_time - net/sched: sch_pie: annotate more data-races in pie_dump_stats() - netpoll: Extract IPv6 address retrieval function - netpoll: pass buffer size to egress_dev() to avoid MAC truncation - page_pool: fix incorrect mp_ops error handling - crypto: af_alg - Cap AEAD AD length to 0x80000000 - i40e: Cleanup PTP pins on probe failure - workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path - netfilter: nf_conntrack_sip: get helper before allocating expectation - audit: fix incorrect inheritable capability in CAPSET records - Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn" - netfilter: nft_ct: fix missing expect put in obj eval - net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled - audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() - [s390x] KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic - [amd64] KVM: x86: Fix Xen hypercall tracepoint argument assignment - netfilter: nf_tables: unconditionally bump set->nelems before insertion (CVE-2026-23272) - ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands - smb/client: fix possible infinite loop and oob read in symlink_data() - [amd64] drm/i915/dp: Fix VSC dynamic range signaling for RGB formats - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans - ALSA: usb-audio: Bound MIDI endpoint descriptor scans - ceph: fix a buffer leak in __ceph_setxattr() - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size - io-wq: check that the predecessor is hashed in io_wq_remove_pending() - [powerpc*] warp: Fix error handling in pika_dtm_thread - netfs: fix error handling in netfs_extract_user_iter() - irqchip/riscv-imsic: Clear interrupt move state during CPU offlining - libceph: Fix potential out-of-bounds access in osdmap_decode() - libceph: Fix potential null-ptr-deref in decode_choose_args() - libceph: Fix potential out-of-bounds access in crush_decode() - libceph: handle rbtree insertion error in decode_choose_args() - [amd64] iommu/vt-d: Disable DMAR for Intel Q35 IGFX - [amd64] drm/i915: skip __i915_request_skip() for already signaled requests - drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() - drm/xe/dma-buf: handle empty bo and UAF races - drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup - drm/gma500/oaktrail_lvds: fix hang on init failure - drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init - iommufd: Fix return value of iommufd_fault_fops_write() - eventfs: Use list_add_tail_rcu() for SRCU-protected children list - drm/v3d: Reject empty multisync extension to prevent infinite loop - btrfs: use inode already stored in local variable at btrfs_rmdir() - btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() - btrfs: fix missing last_unlink_trans update when removing a directory - smb: client: Use FullSessionKey for AES-256 encryption key derivation - btrfs: do not mark inode incompressible after inline attempt fails - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() - sched_ext: Guard scx_dsq_move() against NULL kit->dsq after failed iter_new - mptcp: pm: prio: skip closed subflows - mptcp: drop __mptcp_fastopen_gen_msk_ackseq() - mptcp: fix rx timestamp corruption on fastopen - f2fs: fix incorrect file address mapping when inline inode is unwritten - f2fs: fix false alarm of lockdep on cp_global_sem lock - spi: sifive: Simplify clock handling with devm_clk_get_enabled() - spi: sifive: fix controller deregistration - mptcp: pm: kernel: correctly retransmit ADD_ADDR ID 0 - mptcp: pm: ADD_ADDR rtx: fix potential data-race - mptcp: pm: ADD_ADDR rtx: resched blocked ADD_ADDR quicker - netfs: Fix potential uninitialised var in netfs_extract_user_iter() https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.92 - mptcp: sync the msk->sndbuf at accept() time - mptcp: pm: ADD_ADDR rtx: allow ID 0 - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (CVE-2026-46158) - mptcp: pm: ADD_ADDR rtx: free sk if last (CVE-2026-46170) - ksmbd: validate owner of durable handle on reconnect (CVE-2026-31717) - drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status() (CVE-2026-46216) - [s390x] debug: Reject zero-length input before trimming a newline - Revert "perf cgroup: Update metric leader in evlist__expand_cgroup" - Revert "perf tool_pmu: Fix aggregation on duration_time" - Revert "perf python: Add parse_events function" - Revert "perf tool_pmu: Factor tool events into their own PMU" - bridge: mrp: reject zero test interval to avoid OOM panic (CVE-2026-31420) - spi: spi-dw-dma: fix print error log when wait finish transaction (CVE-2026-31560) - Revert "x86/vdso: Fix output operand size of RDPID" - sched/deadline: Less agressive dl_server handling - sched/deadline: Fix dl_server_stopped() - sched/deadline: Fix dl_server getting stuck - sched/deadline: Fix dl_server behaviour - sched/deadline: Stop dl_server before CPU goes offline - ksmbd: close durable scavenger races against m_fp_list lookups - af_unix: Give up GC if MSG_PEEK intervened. (CVE-2026-23394) - drm/imagination: Synchronize interrupts before suspending the GPU (CVE-2026-23469) - ata: libata-scsi: improve readability of ata_scsi_qc_issue() - ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT - ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS - ata: libata-scsi: do not needlessly defer commands when using PMP with FBS - perf parse-events: Expose/rename config_term_name - Revert "ice: fix double-free of tx_buf skb" - Revert "ice: Remove jumbo_remove step from TX path" - tracing: Fix the bug where bpf_get_stackid returns -EFAULT on the ARM64 - net/mlx5e: Trigger neighbor resolution for unresolved destinations - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init - [amd64] x86/fgraph: Fix return_to_handler regs.rsp value - [amd64] iommu/vt-d: Draining PRQ in sva unbind path when FPD bit set - [riscv64] fgraph: Select HAVE_FUNCTION_GRAPH_TRACER depends on HAVE_DYNAMIC_FTRACE_WITH_ARGS - [riscv64] fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler (CVE-2025-22069) - hwmon: (pmbus/core) Protect regulator operations with mutex - [arm64] Kconfig: Remove selecting replaced HAVE_FUNCTION_GRAPH_RETVAL - sysfs: don't remove existing directory on update failure - mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() - ksmbd: fix null pointer dereference in compare_guid_key() - ksmbd: fix SID memory leak in set_posix_acl_entries_dacl() on overflow - ksmbd: validate SID in parent security descriptor during ACL inheritance - smb: client: require net admin for CIFS SWN netlink - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() - smb: client: use data_len for SMB2 READ encrypted folioq copy - smb/server: promote S_DEL_ON_CLS to S_DEL_PENDING when close - hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX - ALSA: ua101: Reject too-short USB descriptors - ALSA: pcm: Don't setup bogus iov_iter for silencing - ALSA: asihpi: Fix potential OOB array access at reading cache - efi: Allocate runtime workqueue before ACPI init - io_uring/waitid: clear waitid info before copying it to userspace - drivers/base/memory: fix memory block reference leak in poison accounting - ipv6: ioam: refresh hdr pointer before ioam6_event() - mm/memory_hotplug: fix memory block reference leak on remove - net: wwan: iosm: fix potential memory leaks in ipc_imem_init() - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START - Bluetooth: bnep: Fix UAF read of dev->name - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer - Bluetooth: MGMT: validate Add Extended Advertising Data length - Bluetooth: serialize accept_q access - phonet/pep: disable BH around forwarded sk_receive_skb() - net: bcmgenet: keep RBUF EEE/PM disabled - net: ifb: report ethtool stats over num_tx_queues - net: pse-pd: fix sign on -ENOENT check in of_load_pse_pis() - netfilter: ip6t_hbh: reject oversized option lists - netfilter: nf_queue: hold bridge skb->dev while queued - netfilter: ipset: stop hash:* range iteration at end - netfilter: nft_inner: Fix IPv6 inner_thoff desync - sched_ext: Fix missing warning in scx_set_task_state() default case - sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path - cgroup/cpuset: Reset DL migration state on can_attach() failure - fs/ntfs3: handle attr_set_size() errors when truncating files - l2tp: use list_del_rcu in l2tp_session_unhash - qed: fix double free in qed_cxt_tables_alloc() - ring-buffer: Fix reporting of missed events in iterator - ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() - vsock/vmci: fix UAF when peer resets connection during handshake - vsock/virtio: reset connection on receiving queue overflow - wifi: ath11k: clear shared SRNG pointer state on restart - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 - ixgbevf: fix use-after-free in VEPA multicast source pruning - rbd: eliminate a race in lock_dwork draining on unmap - lsm: hold cred_guard_mutex for lsm_set_self_attr() - [arm64] octeontx2-af: CGX: add bounds check to cgx_speed_mbps index - ice: fix setting promisc mode while adding VID filter - ice: restore PTP Rx timestamp config after ethtool set-channels - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() - wifi: mac80211: consume only present negotiated TTLM maps - cifs: Fix busy dentry used after unmounting - tracing: Do not call map->ops->elt_free() if elt_alloc() fails - [arm64] probes: Handle probes on hinted conditional branch instructions - [arm64] KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits - [arm64] KVM: arm64: vgic: Free private_irqs when init fails after allocation - [riscv64] kvm: return SBI_ERR_FAILURE for pmu_snapshot_set_shmem() when OOM - drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe - spi: qup: fix error pointer deref after DMA setup failure - [arm64] phy: tegra: xusb: Fix per-pad high-speed termination calibration - scsi: isci: Fix use-after-free in device removal path - spi: ep93xx: fix error pointer deref after DMA setup failure - spi: sprd: fix error pointer deref after DMA setup failure - spi: ti-qspi: fix use-after-free after DMA setup failure - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - device property: set fwnode->secondary to NULL in fwnode_init() - drm/virtio: use uninterruptible resv lock for plane updates - drm/amdgpu/vpe: Force collaborate sync after TRAP - drm/bridge: it66121: acquire reset GPIO in probe - drm/bridge: megachips: remove bridge when irq request fails - drm/amd/display: Fix integer overflow in bios_get_image() - drm/amd/display: Validate GPIO pin LUT table size before iterating - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async - batman-adv: mcast: fix use-after-free in orig_node RCU release - batman-adv: clear current gateway during teardown - batman-adv: dat: handle forward allocation error - batman-adv: fix fragment reassembly length accounting - batman-adv: fix tp_meter counter underflow during shutdown - batman-adv: frag: disallow unicast fragment in fragment - batman-adv: bla: fix report_work leak on backbone_gw purge - batman-adv: tp_meter: avoid use of uninit sender vars - batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown - batman-adv: tp_meter: fix race condition in send error reporting - batman-adv: tt: fix negative last_changeset_len - batman-adv: tt: fix negative tt_buff_len - hwmon: (pmbus/adm1266) seed timestamp from the real-time clock - hwmon: (pmbus/adm1266) reject implausible blackbox record_count - hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer - hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer - hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR - hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple - hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() - hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() - hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors - [arm64] pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for high pins during suspend/resume - HID: uclogic: Fix regression of input name assignment - [riscv64] mm: Fixup no5lvl failure when vaddr is invalid - [arm64] pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150 - ALSA: hda: cs35l56: Put ACPI device after setting companion - ALSA: hda: cs35l41: Put ACPI device on missing physical node - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() - netfilter: x_tables: unregister the templates first - kprobes: skip non-symbol addresses in kprobe_add_ksym_blacklist() - tcp: Fix imbalanced icsk_accept_queue count. - ice: fix setting RSS VSI hash for E830 - ice: fix locking in ice_dcb_rebuild() - net: lan966x: avoid unregistering netdev on register failure - phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access - NFSD: Fix infinite loop in layout state revocation - irqchip/ath79-cpu: Remove unused function - ublk: reject max_sectors smaller than PAGE_SECTORS in parameter validation - nsfs: fix wrong error code returned for pidns ioctls - irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT - zonefs: handle integer overflow in zonefs_fname_to_fno - tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key(). - [powerpc*] fix dead default for GUEST_STATE_BUFFER_TEST - netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call - netfs: Fix overrun check in netfs_extract_user_iter() - netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone - netfs: Defer the emission of trace_netfs_folio() - netfs: Fix streaming write being overwritten - netfs: Fix potential deadlock in write-through mode - netfs: Fix write streaming disablement if fd open O_RDWR - netfs: Fix early put of sink folio in netfs_read_gaps() - netfs: Fix partial invalidation of streaming-write folio - netfs: Fix a few minor bugs in netfs_page_mkwrite() - netfs: Remove unnecessary references to pages - netfs: Fix folio->private handling in netfs_perform_write() - net: ethernet: cortina: Make RX SKB per-port - net: ethernet: cortina: Drop half-assembled SKB - net: ethernet: cortina: Carry over frag counter - net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference - wifi: ath11k: fix error path leaks in some WMI WOW calls - wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() - wifi: ath10k: skip WMI and beacon transmission when device is wedged - blk-integrity: remove seed for user mapped buffers - block: don't overwrite bip_vcnt in bio_integrity_copy_user() - block: recompute nr_integrity_segments in blk_insert_cloned_request - HID: quirks: really enable the intended work around for appledisplay - block: modify bio_integrity_map_user to accept iov_iter as argument - block: drop direction param from bio_integrity_copy_user() - blk-integrity: use simpler alignment check - blk-integrity: enable p2p source and destination - block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() - accel/qaic: Add overflow check to remap_pfn_range during mmap - net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint - ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics - [arm64] drm/msm/dsi: don't dump registers past the mapped region - [arm64] drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN - [powerpc*] time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring - net: tls: prevent chain-after-chain in plain text SG - net: phy: DP83TC811: add reading of abilities - [amd64] x86/xen: Fix xen_e820_swap_entry_with_ram() - tls: Preserve sk_err across recvmsg() when data has been copied - net/mlx5: Do not restore destination-less TC rules - scsi: sd: Fix return code handling in sd_spinup_disk() - ALSA: scarlett2: Add missing error check when initialise Autogain Status - io_uring/net: punt IORING_OP_BIND async if it needs file create - btrfs: fix squota accounting during enable generation - spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() - [arm64] drm/msm/snapshot: fix dumping of the unaligned regions - drm/xe/gsc: Fix double-free of managed BO in error path - drm/xe/vf: Fix signature of print functions - drm/xe/pf: Fix CFI failure in debugfs access - wifi: ath11k: fix peer resolution on rx path when peer_id=0 - ice: ptp: serialize E825 PHY timer start with PTP lock - [amd64] drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP - [arm64] net: dsa: mt7530: fix FDB entries not aging out with short timeout - [arm64] net: dsa: mt7530: preserve VLAN tags on trapped link-local frames - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer - platform/surface: aggregator_registry: omit battery & AC nodes on Surface Laptop 7 - [amd64] platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL - [amd64] platform/x86: hp_accel: Check ACPI_COMPANION() against NULL - [amd64] platform/x86: intel-hid: Check ACPI_HANDLE() against NULL - [amd64] platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL - RDMA/rtrs: Fix use-after-free in path file creation cleanup - net: bridge: Flush multicast groups when snooping is disabled - bridge: mcast: Fix a possible use-after-free when removing a bridge port - pds_core: fix error handling in pdsc_devcmd_wait - pds_core: fix debugfs_lookup dentry leak and error handling - wifi: mac80211: fix MLE defragmentation - ALSA: seq: Serialize UMP output teardown with event_input - tracing: Avoid NULL return from hist_field_name() on truncation - Bluetooth: btmtk: fix urb->setup_packet leak in error paths - net: ag71xx: check error for platform_get_irq - bpf, skmsg: fix verdict sk_data_ready racing with ktls rx - gpiolib: cdev: use !mem_is_zero() instead of memchr_inv(s, 0, n) - gpio: cdev: check if uAPI v2 config attributes are correctly zeroed - ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() - drm/xe/oa: Fix exec_queue leak on width check in stream open - [arm64] octeontx2-af: npc: Fix allmulticast skip logic for LBK and SDP VFs - net: mana: validate rx_req_idx to prevent out-of-bounds array access - pds_core: ensure null-termination for firmware version strings - net: gro: don't merge zcopy skbs - landlock: Fix TCP handling of short AF_UNSPEC addresses - block: make bio_integrity_map_user() static inline - security/keys: fix missed RCU read section on lookup https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.93 - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size - [arm64] drm/v3d: Fix use-after-free of CPU job query arrays on error path - [arm64] drm/v3d: Release indirect CSD GEM reference on CPU job free - net/sched: cls_fw: fix NULL dereference of "old" filters before change() - net: mctp: ensure our nlmsg responses are initialised (CVE-2026-45930) - xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit - net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked - bcache: fix uninitialized closure object - net: cpsw_new: Fix potential unregister of netdev that has not been registered yet (CVE-2026-43219) - [arm64] Introduce esr_is_ubsan_brk() - [arm64] debug: clean up single_step_handler logic - [arm64] refactor aarch32_break_handler() - [arm64] debug: call software breakpoint handlers statically - [arm64] debug: call step handlers statically - [arm64] debug: remove break/step handler registration infrastructure - [arm64] entry: Add entry and exit functions for debug exceptions - [arm64] debug: split hardware breakpoint exception entry - [arm64] debug: refactor reinstall_suspended_bps() - [arm64] debug: split single stepping exception entry - [arm64] debug: split hardware watchpoint exception entry - [arm64] debug: split brk64 exception entry - [arm64] debug: split bkpt32 exception entry - [arm64] debug: remove debug exception registration infrastructure - [arm64] debug: always unmask interrupts in el0_softstp() - nfc: llcp: Fix use-after-free in llcp_sock_release() - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() - xfrm: Check for underflow in xfrm_state_mtu - nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems - netfilter: synproxy: refresh tcphdr after skb_ensure_writable - netfilter: xt_cpu: prefer raw_smp_processor_id - netfilter: ebtables: fix OOB read in compat_mtw_from_user - tun: free page on short-frame rejection in tun_xdp_one() (CVE-2026-46321) - tun: free page on build_skb failure in tun_xdp_one() (CVE-2026-46322) - vsock: keep poll shutdown state consistent - net: netlink: fix sending unassigned nsid after assigned one - net: netlink: don't set nsid on local notifications - net/smc: Do not re-initialize smc hashtables - [s390x] net/iucv: fix locking in .getsockopt - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() - ALSA: pcm: oss: Fix setup list UAF on proc write error - [amd64] ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors - net: hsr: fix potential OOB access in supervision frame handling - [amd64] accel/ivpu: prevent uninitialized data bug in debugfs - gpio: mxc: fix irq_high handling - net: Avoid checksumming unreadable skb tail on trim - ethtool: rss: fix hkey leak when indir_size is 0 - ethtool: module: avoid leaking a netdev ref on module flash errors - ethtool: module: check fw_flash_in_progress under rtnl_lock - ethtool: module: fix cleanup if socket used for flashing multiple devices - ethtool: cmis: require exact CDB reply length - ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl - net: ethtool: Add new parameters and a function to support EPL - net: ethtool: Add support for writing firmware blocks using EPL payload - ethtool: cmis: validate start_cmd_payload_size from module - ethtool: cmis: validate fw->size against start_cmd_payload_size - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() - ASoC: codecs: simple-mux: Fix enum control bounds check - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() - bonding: refuse to enslave CAN devices - ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES - ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error - ethtool: pse-pd: fix missing ethnl_ops_complete() - ethtool: strset: fix header attribute index in ethnl_req_get_phydev() - ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback - ethtool: eeprom: add more safeties to EEPROM Netlink fallback - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() - net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree" - net/sched: fix packet loop on netem when duplicate is on - net/sched: act_mirred: Move the recursion counter struct netdev_xmit - net/sched: act_mirred: add loop detection - net: Introduce skb tc depth field to track packet loops - net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop - net/sched: act_mirred: Fix return code in early mirred redirect error paths - net/handshake: Use spin_lock_bh for hn_lock - nvme-tcp: store negative errno in queue->tls_err - net/handshake: Pass negative errno through handshake_complete() - remove pointless includes of - net/handshake: Take a long-lived file reference at submit - net/handshake: Drain pending requests at net namespace exit - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close - [arm64,armhf] gpio: rockchip: convert bank->clk to devm_clk_get_enabled() - [amd64,arm64] net: mana: Add NULL guards in teardown path to prevent panic on attach failure - sctp: fix race between sctp_wait_for_connect and peeloff - ipv6: fix possible infinite loop in rt6_fill_node() - ipv6: fix possible infinite loop in fib6_select_path() - net: skbuff: fix pskb_carve leaking zcopy pages - perf: Fix dangling cgroup pointer in cpuctx - batman-adv: v: stop OGMv2 on disabled interface - batman-adv: tvlv: abort OGM send on tvlv append failure - batman-adv: tt: reject oversized local TVLV buffers - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface - batman-adv: tvlv: reject oversized TVLV packets - batman-adv: iv: recover OGM scheduling after forward packet error - batman-adv: tp_meter: avoid role confusion in tp_list - [s390x] cio: Restore GFP_DMA for CHSC allocation - batman-adv: tp_meter: directly shut down timer on cleanup - batman-adv: tt: fix TOCTOU race for reported vlans - batman-adv: tt: avoid empty VLAN responses - batman-adv: bla: avoid double decrement of bla.num_requests - mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303) - media: rc: fix race between unregister and urb/irq callbacks - media: rc: ttusbir: fix inverted error logic - inet: frags: add inet_frag_queue_flush() - inet: frags: flush pending skbs in fqdir_pre_exit() (CVE-2025-68768) - HID: core: Add printk_ratelimited variants to hid_warn() etc - HID: pass the buffer size to hid_report_raw_event - HID: core: introduce hid_safe_input_report() - HID: core: Fix size_t specifier in hid_report_raw_event() - [amd64] drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register - [amd64] drm/i915/psr: Read Intel DPCD workaround register - drm/dp: Add eDP 1.5 bit definition - [amd64] drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used - [arm64] io: Rename ioremap_prot() to __ioremap_prot() - [arm64] io: Extract user memory type in ioremap_prot() (CVE-2026-23346) - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X - batman-adv: tt: prevent TVLV entry number overflow - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer - usb: typec: ucsi: ccg: reject firmware images without a ':' record header - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO - usb: typec: altmodes/displayport: validate count before reading Status Update VDO - usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() - usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT - usb: typec: ucsi: validate connector number in ucsi_connector_change() - USB: serial: safe_serial: fix memory corruption with small endpoint - media: rc: igorplugusb: fix control request setup packet - Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() - HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse - Bluetooth: btusb: Allow firmware re-download when version matches - hpfs: fix a crash if hpfs_map_dnode_bitmap fails - ipc: limit next_id allocation to the valid ID range - auxdisplay: line-display: fix OOB read on zero-length message_store() - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn - Bluetooth: HIDP: fix missing length checks in hidp_input_report() - Bluetooth: ISO: fix UAF in iso_recv_frame - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync - Input: xpad - fix out-of-bounds access for Share button - parport: Fix race between port and client registration (Closes: #1130365) - USB: cdc-acm: Fix bit overlap and move quirk definitions to header - [arm64] KVM: arm64: PMU: Preserve AArch32 counter low bits - [amd64] KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC - [amd64] KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use - [amd64] KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests - [amd64] KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 - [amd64] KVM: SEV: Compute the correct max length of the in-GHCB scratch area - [amd64] KVM: SEV: Check PSC request indices against the actual size of the buffer - [amd64] KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer - [amd64] KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() - iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux - iio: adc: npcm: fix unbalanced clk_disable_unprepare() - iio: dac: max5821: fix return value check in powerdown sync - iio: dac: ad5686: fix input raw value check - iio: dac: ad5686: acquire lock when doing powerdown control - iio: adc: mt6359: fix unchecked return value in mt6358_read_imp - iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw - iio: gyro: itg3200: fix i2c read into the wrong stack location - iio: gyro: adis16260: fix division by zero in write_raw - iio: ssp_sensors: cancel delayed work_refresh on remove - iio: temperature: tsys01: fix broken PROM checksum validation - iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL - iio: light: cm3323: fix reg_conf not being initialized correctly - iio: buffer: hw-consumer: fix use-after-free in error path - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() - USB: serial: omninet: fix memory corruption with small endpoint - usb: cdns3: gadget: fix request skipping after clearing halt - usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure - usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles - usb: dwc2: Fix use after free in debug code - Input: elan_i2c - validate firmware size before use - wireguard: send: append trailer after expanding head - bpf: sockmap: fix tail fragment offset in bpf_msg_push_data - macsec: fix replay protection at XPN lower-PN wrap - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() - [arm64] ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params - ipv6: exthdrs: refresh nh after handling HAO option - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). - ipv6: validate extension header length before copying to cmsg - xfrm: input: hold netns during deferred transport reinjection - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - net: skbuff: fix missing zerocopy reference in pskb_carve helpers - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() - nfc: hci: fix out-of-bounds read in HCP header parsing - xfrm: route MIGRATE notifications to caller's netns - xfrm: ah: use skb_to_full_sk in async output callbacks - ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check - [arm64] ASoC: qcom: q6asm-dai: close stream only when running - [arm64] ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks - xfrm: esp: restore combined single-frag length gate - Input: xpad - add "Nova 2 Lite" from GameSir - Input: xpad - add support for ASUS ROG RAIKIRI II - ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem - Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 - [amd64] comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() - [amd64] comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() - counter: Fix refcount leak in counter_alloc() error path - tty: serial: pch_uart: add check for dma_alloc_coherent() - tty: serial: samsung: Remove redundant port lock acquisition in rx helpers - usb: chipidea: core: convert ci_role_switch to local variable - usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval - USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers - usb: storage: Add quirks for PNY Elite Portable SSD - usbip: vudc: Fix use after free bug in vudc_remove due to race condition - usb: usbtmc: check URB actual_length for interrupt-IN notifications - usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize - usb: typec: tcpm: improve handling of DISCOVER_MODES failures - USB: serial: option: add MeiG SRM813Q - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL - USB: serial: belkin_sa: validate interrupt status length - USB: serial: cypress_m8: validate interrupt packet headers - USB: serial: keyspan: fix missing indat transfer sanity check - USB: serial: mxuport: fix memory corruption with small endpoint - USB: serial: mct_u232: fix missing interrupt-in transfer sanity check - usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind - usb: gadget: net2280: Fix double free in probe error path - usb: gadget: f_hid: fix device reference leak in hidg_alloc() - usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling - usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports - usb: gadget: f_fs: copy only received bytes on short ep0 read - usb: gadget: f_fs: serialize DMABUF cancel against request completion - [amd64] thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() - [amd64] thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf - scsi: target: iscsi: Validate CHAP_R length before base64 decode - drm/hyperv: validate resolution_count and fix WIN8 fallback - drm/hyperv: validate VMBus packet size in receive callback - [amd64] drm/i915: Fix potential UAF in TTM object purge - drm/amd/pm/si: Disregard vblank time when no displays are connected - serial: altera_jtaguart: handle uart_add_one_port() failures - serial: qcom-geni: fix UART_RX_PAR_EN bit position - serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ - serial: sh-sci: fix memory region release in error path - serial: zs: Fix swapped RI/DSR modem line transition counting - serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma - drm/amdkfd: fix NULL pointer bug in svm_range_set_attr - drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger - drm/amdkfd: Check for pdd drm file first in CRIU restore path - serial: dz: Fix bootconsole message clobbering at chip reset - serial: dz: Fix bootconsole handover lockup - serial: dz: Convert to use a platform device - serial: zs: Fix bootconsole handover lockup - serial: zs: Switch to using channel reset - serial: zs: Convert to use a platform device - USB: serial: cypress_m8: fix memory corruption with small endpoint - USB: serial: digi_acceleport: fix memory corruption with small endpoints - xhci: tegra: Fix ghost USB device on dual-role port unplug - iommu: Skip PASID validation for devices without PASID capability - [amd64] x86/boot: Disable stack protector for early boot code - [amd64] x86/kexec: Disable KCOV instrumentation after load_segments() (CVE-2026-43331) - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer - serdev: Provide a bustype shutdown function - Bluetooth: hci_qca: Migrate to serdev specific shutdown function - Bluetooth: hci_qca: Convert timeout from jiffies to ms - ALSA: scarlett2: Return ENOSPC for out-of-bounds flash writes - ALSA: scarlett2: Allow flash writes ending at segment boundary - mm/memory: fix spurious warning when unmapping device-private/exclusive pages - [amd64] platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery - net: hsr: defer node table free until after RCU readers - mptcp: pm: fix ADD_ADDR timer infinite retry on option space insufficient - ice: fix VF queue configuration with low MTU values - ring-buffer: Flush and stop persistent ring buffer on panic - mptcp: cleanup fallback dummy mapping generation - mptcp: reset rcv wnd on disconnect - [arm64] tlb: Flush walk cache when unsharing PMD tables - [arm64] octeontx2-pf: avoid double free of pool->stack on AQ init failure - mptcp: introduce the mptcp_init_skb helper - mptcp: handle first subflow closing consistently - mptcp: do not drop partial packets - mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() - iio: chemical: scd30: Use guard(mutex) to allow early returns - iio: chemical: scd30: fix division by zero in write_raw - iio: dac: ad5686: fix ref bit initialization for single-channel parts - ALSA: firewire-motu: Protect register DSP event queue positions - [arm64] usb: dwc3: xilinx: fix error handling in zynqmp init error paths - usb: musb: omap2430: Fix use-after-free in omap2430_probe() - usb: typec: ucsi: Check if power role change actually happened before handling - [amd64] thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() - usb: typec: ucsi: Don't update power_supply on power role change if not connected - [amd64] x86/alternatives: Rename 'apply_relocation()' to 'text_poke_apply_relocation()' - [amd64] x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines - hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock - hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock - hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock - mm: perform all memfd seal checks in a single place - mm/memfd: fix spelling and grammatical issues - memfd: deny writeable mappings when implying SEAL_WRITE - usb: core: Fix SuperSpeed root hub wMaxPacketSize - ethtool: cmis_cdb: Fix incorrect read / write length extension - net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow - [arm64] KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.94 - bpf: Free reuseport cBPF prog after RCU grace period. (CVE-2026-52910) - USB: serial: mct_u232: fix memory corruption with small endpoint - [armhf] group is_permission_fault() with is_translation_fault() - [armhf] allow __do_kernel_fault() to report execution of memory faults - [armhf] fix hash_name() fault - [armhf] fix branch predictor hardening - net: phy: micrel: fix LAN8814 QSGMII soft reset - wifi: remove zero-length arrays - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl - ipv6: mcast: Fix use-after-free when processing MLD queries - net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS - [arm64] tee: optee: prevent use-after-free when the client exits before the supplicant - [arm64]soc: qcom: ice: Return -ENODEV if the ICE platform device is not found - erofs: add sysfs node to drop internal caches - erofs: tidy up synchronous decompression - erofs: fix use-after-free on sbi->sync_decompress - ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers - netfilter: xt_NFQUEUE: prefer raw_smp_processor_id - ipvs: clear the svc scheduler ptr early on edit - netfilter: synproxy: add mutex to guard hook reference counting - netfilter: conntrack_irc: fix possible out-of-bounds read - netfilter: nft_ct: bail out on template ct in get eval - netfilter: bridge: make ebt_snat ARP rewrite writable - dm cache policy smq: check allocation under invalidate lock - net/sched: act_api: use RCU with deferred freeing for action lifecycle - 6lowpan: fix off-by-one in multicast context address compression - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() - devlink: Release nested relation on devlink free - [arm64] drm/imx: Fix three kernel-doc warnings in dcss-scaler.c - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap - pcnet32: stop holding device spin lock during napi_complete_done - net: Annotate sk->sk_write_space() for UDP SOCKMAP. - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). - net: garp: fix unsigned integer underflow in garp_pdu_parse_attr - net: lan743x: permit VLAN-tagged packets up to configured MTU - net: fec: fix pinctrl default state restore order on resume - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() - Bluetooth: MGMT: validate advertising TLV before type checks - Bluetooth: RFCOMM: validate skb length in MCC handlers - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling - Bluetooth: bnep: reject short frames before parsing - Bluetooth: fix memory leak in error path of hci_alloc_dev() - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync - Bluetooth: ISO: Fix not using bc_sid as advertisement SID - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls - Bluetooth: MGMT: Fix backward compatibility with userspace - [arm64] octeontx2-pf: Fix NDC sync operation errors - [arm64] octeontx2-af: Fix initialization of mcam's entry2target_pffunc field - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options - ptp: vclock: Switch from RCU to SRCU - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown - net_sched: act_pedit: use RCU in tcf_pedit_dump() - net/sched: fix pedit partial COW leading to page cache corruption (CVE-2026-46331) - [arm64] octeontx2-af: npc: Fix CPT channel mask in npc_install_flow - vxlan: vnifilter: send notification on VNI add - vxlan: vnifilter: fix spurious notification on VNI update - ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr - sctp: purge outqueue on stale COOKIE-ECHO handling - ipmi: Fix rcu_read_unlock to srcu_read_unlock in handle_read_event_rsp - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() - time: Fix off-by-one in settimeofday() usec validation - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams - ALSA: seq: dummy: fix UMP event stack overread - ima: kexec: skip IMA segment validation after kexec soft reboot - ima: kexec: move IMA log copy from kexec load to execute - spi: cadence-quadspi: fix unclocked access on unbind (CVE-2026-46203) - tools/rv: Fix cleanup after failed trace setup - tap: free page on error paths in tap_get_user_xdp() (CVE-2026-46320) - [arm64] tlb: Allow XZR argument to TLBI ops - [arm64] tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI - iomap: don't revert iov_iter on partially completed buffered writes - dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() - netlabel: validate unlabeled address and mask attribute lengths - gpio: mvebu: fix NULL pointer dereference in suspend/resume - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls - tcp: restrict SO_ATTACH_FILTER to priv users - net: add pskb_may_pull() to skb_gro_receive_list() - net/mlx4: avoid GCC 10 __bad_copy_from() false positive - net: ibm: emac: Fix use-after-free during device removal - netdev: fix double-free in netdev_nl_bind_rx_doit() - net: phy: clean the sfp upstream if phy probing fails - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure - net/mlx5: Use effective affinity mask for IRQ selection - ipv6: sit: reload inner IPv6 header after GSO offloads - net: openvswitch: fix possible kfree_skb of ERR_PTR - r8152: handle the return value of usb_reset_device() - gpio: zynq: fix runtime PM leak on remove - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() - net: guard timestamp cmsgs to real error queue skbs - net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() - rds: mark snapshot pages dirty in rds_info_getsockopt() - netfilter: revalidate bridge ports - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister - netfilter: x_tables: avoid leaking percpu counter pointers - netfilter: nf_log: validate MAC header was set before dumping it - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag - [arm64,armhf] net: mvpp2: sync RX data at the hardware packet offset - [arm64,armhf] net: mvpp2: limit XDP frame size to the RX buffer - [arm64,armhf] net: mvpp2: Add metadata support for xdp mode - [arm64,armhf] net: mvpp2: refill RX buffers before XDP or skb use - [arm64,armhf] net: mvpp2: build skb from XDP-adjusted data on XDP_PASS - ipv6: Fix a potential NPD in cleanup_prefix_route() - netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116) - writeback: Avoid contention on wb->list_lock when switching inodes - writeback: Fix use after free in inode_switch_wbs_work_fn() - xfrm: hold device only for the asynchronous decryption - xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) - [amd64] KVM: VMX: Update SVI during runtime APICv activation - [arm64] clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked - clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs - [arm64] clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time - drm/virtio: Fix driver removal with disabled KMS - [arm64,armhf] drm/vc4: fix krealloc() memory leak - drm/xe: fix refcount leak in xe_range_fence_insert() - netfilter: nft_tunnel: fix use-after-free on object destroy - [arm64] tee: shm: fix shm leak in register_shm_helper() - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig - [arm64] soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() - [amd64] accel/ivpu: Add bounds checks for firmware log indices - [amd64] accel/ivpu: Add buffer overflow check in MS get_info_ioctl - [amd64] accel/ivpu: Fix signed integer truncation in IPC receive - tracing/probes: Point the error offset correctly for eprobe argument error - mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation - KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying - [amd64] KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA - [amd64] drm/i915/gem: Fix phys BO pread/pwrite with offset - pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init - ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL - xfrm: espintcp: do not reuse an in-progress partial send - USB: serial: io_ti: fix heap overflow in get_manuf_info() - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() - USB: serial: option: add usb-id for Dell Wireless DW5826e-m - USB: serial: kl5kusb105: fix bulk-out buffer overflow - ALSA: timer: Forcibly close timer instances at closing - ALSA: timer: Fix UAF at snd_timer_user_params() - io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() - drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() - mm/huge_memory: update file PMD counter before folio_put() - mm/damon/ops-common: call folio_test_lru() after folio_get() - RDMA/srp: bound SRP_RSP sense copy by the received length - zram: fix use-after-free in zram_bvec_write_partial() - udp: clear skb->dev before running a sockmap verdict - mptcp: fix retransmission loop when csum is enabled - mptcp: close TOCTOU race while computing rcv_wnd - mptcp: allow subflow rcv wnd to shrink - mptcp: sockopt: check timestamping ret value - mptcp: add-addr: always drop other suboptions - wifi: nl80211: reject oversized EMA RNR lists - vsock/vmci: fix sk_ack_backlog leak on failed handshake - timers/migration: Fix livelock in tmigr_handle_remote_up() - ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write - bnxt_en: Fix NULL pointer dereference - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN - inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush - pidfd: refuse access to tasks that have started exiting harder - fs/qnx6: fix pointer arithmetic in directory iteration - fuse: reject fuse_notify() pagecache ops on directories - i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() - i2c: stm32f7: fix timing computation ignoring i2c-analog-filter - i2c: tegra: Fix NOIRQ suspend/resume - Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) - Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard - ipc/shm: serialize orphan cleanup with shm_nattch updates - misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context - misc: fastrpc: fix use-after-free race in fastrpc_map_create - misc: fastrpc: fix DMA address corruption due to find_vma misuse - misc: fastrpc: Fix NULL pointer dereference in rpmsg callback - net/mlx5: Reorder completion before putting command entry in cmd_work_handler - net: bonding: fix NULL pointer dereference in bond_do_ioctl() - net: mv643xx: fix OF node refcount - net: rds: clear i_sends on setup unwind - nvmem: core: fix use-after-free bugs in error paths - nvmem: layouts: onie-tlv: fix hang on unknown types - [arm64] octeontx2-af: fix memory leak in rvu_setup_hw_resources() - io_uring/kbuf: don't truncate end buffer for bundles - io_uring/wait: fix min_timeout behavior - mm/hugetlb: restore reservation on error in hugetlb folio copy paths - mmc: core: Fix host controller programming for fixed driver type - mmc: dw_mmc-rockchip: Add missing private data for very old controllers - mmc: litex_mmc: Set mandatory idle clocks before CMD0 - mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC - mmc: sdhci: add signal voltage switch in sdhci_resume_host - pmdomain: imx: fix OF node refcount - rtase: Avoid sleeping in get_stats64() - rtase: Reset TX subqueue when clearing TX ring - sctp: diag: reject stale associations in dump_one path - sctp: stream: fully roll back denied add-stream state - [amd64] thunderbolt: Reject zero-length property entries in validator - [amd64] thunderbolt: Bound root directory content to block size - [amd64] thunderbolt: Clamp XDomain response data copy to allocation size - [amd64] thunderbolt: Validate XDomain request packet size before type cast - [amd64] thunderbolt: Limit XDomain response copy to actual frame size - [arm64] slimbus: qcom-ngd-ctrl: fix OF node refcount - [arm64] slimbus: qcom-ngd-ctrl: Fix up platform_driver registration - [arm64] slimbus: qcom-ngd-ctrl: Fix probe error path ordering - [arm64] slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd - [arm64] slimbus: qcom-ngd-ctrl: Initialize controller resources in controller - [arm64] slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership - [arm64] slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD - [arm64] slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock - drm/amdkfd: fix NULL dereference in get_queue_ids() - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 - drm/xe: Clear pending_disable before signaling suspend fence - [arm64,armhf] drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups - drm/amdgpu: restart the CS if some parts of the VM are still invalidated - drm/amd/pm: fix smu13 power limit default/cap calculation - drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 - drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range - drm/amd/display: Bound VBIOS record-chain walk loops - drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size - drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs - drm/amd/display: Use krealloc_array() in dal_vector_reserve() - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling - driver core: reject devices with unregistered buses - mailbox: Fix NULL message support in mbox_send_message() - hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf - sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task() - netfilter: nft_fib: fix stale stack leak via the OIFNAME register - mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison - RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper - RDMA/umem: Move umem dmabuf revoke logic into helper function - RDMA/umem: Add helpers for umem dmabuf revoke lock - RDMA: During rereg_mr ensure that REREG_ACCESS is compatible - RDMA/umem: fix kernel-doc warnings - RDMA: Move DMA block iterator logic into dedicated files - RDMA/umem: Fix truncation for block sizes >= 4G - mm/hugetlb: avoid false positive lockdep assertion - mptcp: fix missing wakeups in edge scenarios - ipmi:ssif: Remove unnecessary indention - ipmi:ssif: NULL thread on error - ipvs: skip ipv6 extension headers for csum checks (CVE-2026-45850) - vsock/virtio: fix potential unbounded skb queue - vsock/virtio: fix skb overhead accounting to preserve full buf_alloc - block: fix handling of dead zone write plugs - [arm64] cputype: Add NVIDIA Olympus definitions - [arm64] cputype: Add C1-Ultra definitions - [arm64] cputype: Add C1-Premium definitions - [arm64] errata: Mitigate TLBI errata on various Arm CPUs - [arm64] errata: Mitigate TLBI errata on NVIDIA Olympus CPU - [arm64] errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU - net: introduce EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() - tcp: use EXPORT_IPV6_MOD[_GPL]() - tcp: secure_seq: add back ports to TS offset (CVE-2026-23247) - mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation - vsock/virtio: fix skb overhead overflow on 32-bit builds - netfilter: require Ethernet MAC header before using eth_hdr() [ Salvatore Bonaccorso ] * [rt] Refresh "ARM: enable irq in translation/section permission fault" * ip6_vti: set netns_immutable on the fallback device. (CVE-2026-52909) -- Salvatore Bonaccorso Sat, 20 Jun 2026 09:03:06 +0200 linux (6.12.90-2~bpo12+1) bookworm-backports; urgency=high * Rebuild for bookworm-backports -- Ben Hutchings Thu, 28 May 2026 09:16:24 +0200 linux (6.12.90-2) trixie-security; urgency=high * smb: client: reject userspace cifs.spnego descriptions * net/rds: reset op_nents when zerocopy page pin fails (CVE-2026-43494) -- Salvatore Bonaccorso Wed, 27 May 2026 09:38:07 +0200 linux (6.12.90-1~bpo12+1) bookworm-backports; urgency=high * Rebuild for bookworm-backports -- Ben Hutchings Mon, 25 May 2026 21:09:08 +0200 linux (6.12.90-1) trixie-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.89 https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.90 - HID: playstation: Clamp num_touch_reports - media: uvcvideo: Enable VB2_DMABUF for metadata stream - [arm64] dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux - [arm64] regulator: mt6357: fix OF node reference imbalance - [arm64,armhf] regulator: rk808: fix OF node reference imbalance - media: videobuf2: Set vma_flags in vb2_dma_sg_mmap - [amd64] media: intel/ipu6: fix error pointer dereference - media: saa7164: add ioremap return checks and cleanups - spi: aspeed-smc: fix controller deregistration - [amd64] platform/x86: hp-wmi: Ignore backlight and FnLock events - vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy - [arm64] drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() - [amd64] drm/i915/psr: Init variable to avoid early exit from et alignment loop - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure - drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count. - drm/amdgpu: gate VM CPU HDP flush on reset lock - drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x - drm/amdkfd: Add upper bound check for num_of_nodes - drm/amdgpu: Add bounds checking to ib_{get,set}_value - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB - drm/amdgpu/vce: Prevent partial address patches - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg - drm/amd/display: Change dither policy for 10 bpc output back to dithering - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() - drm/amdkfd: validate SVM ioctl nattr against buffer size - drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() - drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() - drm/radeon: add missing revision check for CI - drm/amdgpu: zero-initialize GART table on allocation - drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds - drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ - drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds - drm/amdkfd: Make all TLB-flushes heavy-weight - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission - drm/amdgpu/pm: add missing revision check for CI - drm/amdgpu/pm: align Hawaii mclk workaround with radeon - [arm64] dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - batman-adv: fix integer overflow on buff_pos - batman-adv: reject new tp_meter sessions during teardown - batman-adv: stop caching unowned originator pointers in BAT IV - batman-adv: bla: prevent use-after-free when deleting claims - batman-adv: bla: only purge non-released claims - batman-adv: bla: put backbone reference on failed claim hash insert - usb: typec: tcpm: reset internal port states on soft reset AMS - usb: dwc3: Move GUID programming after PHY initialization - ALSA: hda: cs35l56: Propagate ASP TX source control errors - ALSA: misc: Use guard() for spin locks - ALSA: core: Serialize deferred fasync state checks - ALSA: seq: Notify client and port info changes - ALSA: seq: Fix UMP group 16 filtering - Bluetooth: hci_conn: fix potential UAF in create_big_sync - [arm64,armhf] spi: tegra20-sflash: fix controller deregistration - [arm64,armhf] spi: tegra114: fix controller deregistration - mm/hugetlb_cma: round up per_node before logging it - block: cleanup blkdev_report_zones() - block: reorganize struct blk_zone_wplug - block: fix zone write plug removal - tracefs: Fix default permissions not being applied on initial mount - fbcon: Avoid OOB font access if console rotation fails - mm/damon/core: disallow time-quota setting zero esz - mm/damon/core: implement damon_kdamond_pid() - mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values - mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values - bonding: fix use-after-free due to enslave fail after slave array update (CVE-2026-23171) - io_uring/kbuf: support min length left for incremental buffers - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() - btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() - btrfs: fix double free in create_space_info_sub_group() error path - btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak - tracing/probes: Limit size of event probe to 3K - batman-adv: stop tp_meter sessions during mesh teardown - batman-adv: tp_meter: fix tp_num leak on kmalloc failure - vsock: fix buffer size clamping order - vsock/virtio: fix length and offset in tap skb for split packets - vsock/virtio: fix empty payload in tap skb for non-linear buffers - vsock/virtio: fix accept queue count leak on transport mismatch - drm/amdgpu/vcn3: Avoid overflow on msg bound check - drm/amdgpu/vcn4: Avoid overflow on msg bound check [ Salvatore Bonaccorso ] * Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (Closes: #1136790) * net: skbuff: preserve shared-frag marker during coalescing (CVE-2026-46300) * net: skbuff: propagate shared-frag marker through frag-transfer helpers -- Salvatore Bonaccorso Fri, 22 May 2026 21:01:16 +0200 linux (6.12.88-1~bpo12+1) bookworm-backports; urgency=high * Rebuild for bookworm-backports -- Ben Hutchings Sat, 16 May 2026 10:53:21 +0200 linux (6.12.88-1) trixie-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.87 https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.88 - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() - ipmi: Add limits to event and receive message requests - ipmi: Check event message buffer response for bad data - ipmi:si: Return state to normal if message allocation fails - fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free - ACPI: scan: Use acpi_dev_put() in object add error paths - ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO - ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug - ACPI: video: force native backlight on HP OMEN 16 (8A44) - ASoC: SOF: Don't allow pointer operations on unconfigured streams - spi: rockchip: fix controller deregistration - ksmbd: rewrite stop_sessions() with restartable iteration - mm: convert mm_lock_seq to a proper seqcount - [amd64] x86: shadow stacks: proper error handling for mmap lock (CVE-2026-43109) - [amd64] x86/shstk: Prevent deadlock during shstk sigreturn - [amd64] KVM: x86: Fix shadow paging use-after-free due to unexpected GFN - [amd64] iommu/amd: Use atomic64_inc_return() in iommu.c - [amd64] iommu/amd: serialize sequence allocation under concurrent TLB invalidations (CVE-2026-43220) (Closes: #1135313) - flow_dissector: do not dissect PPPoE PFC frames - net: txgbe: fix RTNL assertion warning when remove module - net: af_key: zero aligned sockaddr tail in PF_KEY exports (CVE-2026-43088) - [amd64] KVM: SVM: check validity of VMCB controls when returning from SMM - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked - Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (CVE-2026-31499) - exit: prevent preemption of oopsing TASK_DEAD task - wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr - wifi: mt76: mt7925: fix incorrect length field in txpower command - wifi: mt76: mt7921: fix a potential clc buffer length underflow - wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work - wifi: b43legacy: enforce bounds check on firmware key index in RX path - wifi: mac80211: drop stray 'static' from fast-RX rx_result - wifi: rsi: fix kthread lifetime race between self-exit and external-stop - wifi: mac80211: use safe list iteration in radar detect work - wifi: ath5k: do not access array OOB (Closes: #1119093) - wifi: mac80211: remove station if connection prep fails - wifi: b43: enforce bounds check on firmware key index in b43_rx() - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task - usb: usblp: fix heap leak in IEEE 1284 device ID via short response - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl - ALSA: usb-audio: midi2: Restart output URBs on resume - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() - ALSA: usb-audio: Fix UAC3 cluster descriptor size check - USB: omap_udc: DMA: Don't enable burst 4 mode - USB: serial: option: add Telit Cinterion LE910Cx compositions - usb: ulpi: fix memory leak on ulpi_register() error paths - ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger - ALSA: firewire-tascam: Do not drop unread control events - xfrm: provide message size for XFRM_MSG_MAPPING - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() - xfrm: ah: account for ESN high bits in async callbacks - selinux: don't reserve xattr slot when we won't fill it - selinux: shrink critical section in sel_write_load() - selinux: prune /sys/fs/selinux/disable - Bluetooth: virtio_bt: clamp rx length before skb_put - Bluetooth: virtio_bt: validate rx pkt_type header length - Bluetooth: btmtk: validate WMT event SKB length before struct access - Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() - [armhf] spi: sun4i: fix controller deregistration - [armhf] spi: ti-qspi: fix controller deregistration - spi: sun6i: fix controller deregistration - fanotify: fix false positive on permission events - [arm64] KVM: arm64: Fix kvm_vcpu_initialized() macro parameter - mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo - sound: ua101: fix division by zero at probe - net: libwx: fix VF illegal register access - ip6_gre: Use cached t->net in ip6erspan_changelink(). - net/rds: handle zerocopy send cleanup before the message is queued - net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler - hwmon: (ltc2992) Clamp threshold writes to hardware range - hwmon: (ltc2992) Fix u32 overflow in power read path - clk: rk808: fix OF node reference imbalance - hwmon: (corsair-psu) Close HID device on probe errors - af_unix: Reject SIOCATMARK on non-stream sockets - block: add pgmap check to biovec_phys_mergeable - cifs: abort open_cached_dir if we don't request leases - cifs: change_conf needs to be called for session setup - extcon: ptn5150: handle pending IRQ events during system resume - gpio: of: clear OF_POPULATED on hog nodes in remove path - hv_sock: fix ARM64 support - ibmveth: Disable GSO for packets with small MSS - ice: fix double free in ice_sf_eth_activate() error path - spi: microchip-core-qspi: fix controller deregistration - udf: reject descriptors with oversized CRC length - thermal: core: Free thermal zone ID later during removal - thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata - thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp - spi: topcliff-pch: fix controller deregistration - spi: topcliff-pch: fix use-after-free on unbind - clk: imx: imx8-acm: fix flags for acm clocks - clk: microchip: mpfs-ccc: fix out of bounds access during output registration - cpuidle: powerpc: avoid double clear when breaking snooze - [amd64] ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table - [arm64] ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop - [arm64] ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens - [arm64] ASoC: qcom: q6apm: remove child devices when apm is removed - btrfs: fix double free in create_space_info() error path - dm-thin: fix metadata refcount underflow - dm: don't report warning when doing deferred remove - dm: fix a buffer overflow in ioctl processing - eventfs: Hold eventfs_mutex and SRCU when remount walks events - dm-verity-fec: correctly reject too-small FEC devices - dm-verity-fec: correctly reject too-small hash devices - isofs: validate Rock Ridge CE continuation extent against volume size - isofs: validate block number from NFS file handle in isofs_export_iget - [arm64] iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update - lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() - lib/scatterlist: fix length calculations in extract_kvec_to_sg - lib/scatterlist: fix temp buffer in extract_user_to_sg() - libceph: Fix slab-out-of-bounds access in auth message processing - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies - nvme-apple: drop invalid put of admin queue reference count - nvmet-tcp: fix race between ICReq handling and queue teardown - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free - openvswitch: vport: fix self-deadlock on release of tunnel ports - pmdomain: core: Fix detach procedure for virtual devices in genpd - [arm64] RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - [s390x] debug: Reject zero-length input in debug_input_flush_fn() - smb/client: fix out-of-bounds read in smb2_compound_op() - smb/client: fix out-of-bounds read in symlink_data() - smb: client: use kzalloc to zero-initialize security descriptor buffer - smb: client: validate dacloffset before building DACL pointers - [amd64] KVM: x86: check for nEPT/nNPT in slow flush hypercalls - mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock - PCI: Update saved_config_space upon resource assignment (Closes: #1131025) - PCI/AER: Clear only error bits in PCIe Device Status - PCI/AER: Stop ruling out unbound devices as error source - PCI/ASPM: Fix pci_clear_and_set_config_dword() usage - power: supply: max17042: avoid overflow when determining health - RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() - RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() - RDMA/mana: Validate rx_hash_key_len - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads - RDMA/rxe: Reject unknown opcodes before ICRC processing - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path - mptcp: fastclose msk when linger time is 0 - mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure - mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure - mptcp: sockopt: set timestamp flags on subflow socket, not msk - mptcp: fix scheduling with atomic in timestamp sockopt - f2fs: add READ_ONCE() for i_blocks in f2fs_update_inode() - f2fs: fix fiemap boundary handling when read extent cache is incomplete - f2fs: fix incorrect multidevice info in trace_f2fs_map_blocks() - f2fs: fix node_cnt race between extent node destroy and writeback - f2fs: fix uninitialized kobject put in f2fs_init_sysfs() - [arm64] KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value - [arm64] KVM: arm64: Fix initialisation order in __pkvm_init_finalise() - bpf: Fix use-after-free in arena_vm_close on fork - fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info - fs: prepare for adding LSM blob to backing_file - dma-mapping: drop unneeded includes from dma-mapping.h - dma-mapping: add __dma_from_device_group_begin()/end() - hwmon: (powerz) Avoid cacheline sharing for DMA buffer - mmc: core: Optimize time for secure erase/trim for some Kingston eMMCs - udf: fix partition descriptor append bookkeeping - mtd: spinand: winbond: Declare the QE bit on W25NxxJW - hfsplus: fix uninit-value by validating catalog record size - hfsplus: fix held lock freed on hfsplus_fill_super() - erofs: move {in,out}pages into struct z_erofs_decompress_req - erofs: tidy up z_erofs_lz4_handle_overlap() - erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() - gtp: disable BH before calling udp_tunnel_xmit_skb() - printk: add print_hex_dump_devel() - crypto: caam - guard HMAC key hex dumps in hash_digest_key - ALSA: aloop: Fix peer runtime UAF during format-change stop - net: stmmac: avoid shadowing global buf_sz - net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY() - net: stmmac: Prevent NULL deref when RX memory exhausted - wifi: mt76: mt7925: fix incorrect TLV length in CLC command - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() - [arm64] KVM: arm64: Wake-up from WFI when iqrchip is in userspace - [amd64] x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache - ksmbd: validate inherited ACE SID length [ Salvatore Bonaccorso ] * ptrace: slightly saner 'get_dumpable()' logic -- Salvatore Bonaccorso Fri, 15 May 2026 11:52:56 +0200 linux (6.12.86-1~bpo12+1) bookworm-backports; urgency=high * Rebuild for bookworm-backports -- Ben Hutchings Fri, 08 May 2026 15:01:32 +0200 linux (6.12.86-1) trixie-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.86 - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES - ALSA: usb-audio: Avoid false E-MU sample-rate notifications - ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch - usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() - usb: chipidea: otg: not wait vbus drop if use role_switch - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change - ALSA: usb-audio: Evaluate packsize caps at the right place - LoongArch: Add spectre boundry for syscall dispatch table - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check - leds: qcom-lpg: Check for array overflow when selecting the high resolution - greybus: gb-beagleplay: bound bootloader receive buffering - greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames() - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() - ibmasm: fix OOB reads in command_file_write due to missing size checks - ibmasm: fix heap over-read in ibmasm_send_i2o_message() - driver core: Don't let a device probe until it's ready - drm/nouveau: fix nvkm_device leak on aperture removal failure - kbuild: rust: allow `clippy::uninlined_format_args` - firmware: google: framebuffer: Do not mark framebuffer as busy - arm64/mm: Enable batched TLB flush in unmap_hotplug_range() - padata: Fix pd UAF once and for all (CVE-2025-38584) - padata: Remove comment for reorder_work - rust: init: fix `clippy::undocumented_unsafe_blocks` warnings - drm/amdgpu: Use vmemdup_array_user in amdgpu_bo_create_list_entry_array - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (CVE-2026-23468) - device property: Make modifications of fwnode "flags" thread safe - ocfs2: split transactions in dio completion to avoid credit exhaustion - zram: do not forget to endio for partial discard requests - wifi: rtw88: check for PCI upstream bridge existence - vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex - vfio/cdx: Fix NULL pointer dereference in interrupt trigger path - um: drivers: call kernel_strrchr() explicitly in cow_user.c - spi: imx: fix use-after-free on unbind - spi: ch341: fix memory leaks on probe failures - mm/memory_hotplug: fix hwpoisoned large folio handling in do_migrate_range() - crypto: pcrypt - Fix handling of MAY_BACKLOG requests - of: unittest: fix use-after-free in of_unittest_changeset() - of: unittest: fix use-after-free in testdrv_probe() - hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt - media: amphion: Fix race between m2m job_abort and device_run - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() - net: caif: clear client service pointer on teardown - net: strparser: fix skb_head leak in strp_abort_strp() - media: mtk-jpeg: fix use-after-free in release path due to uncancelled work - crypto: atmel-sha204a - Fix OTP sysfs read and error handling - PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown - Revert "ALSA: usb: Increase volume range that triggers a warning" - PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete - lib/ts_kmp: fix integer overflow in pattern length calculation - media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() - net: qrtr: ns: Fix use-after-free in driver remove() - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() - ALSA: aoa: i2sbus: fix OF node lifetime handling - ALSA: ctxfi: Add fallback to default RSR for S/PDIF - ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes - erofs: fix the out-of-bounds nameoff handling for trailing dirents - jbd2: fix deadlock in jbd2_journal_cancel_revoke() - md/raid10: fix deadlock with check operation and nowait requests - mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused - mtd: docg3: fix use-after-free in docg3_release() - nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 - nvme: respect NVME_QUIRK_DISABLE_WRITE_ZEROES when wzsl is set - parisc: _llseek syscall is only available for 32-bit userspace - remoteproc: xlnx: Only access buffer information if IPI is buffered - sched: Use u64 for bandwidth ratio calculations - rbd: fix null-ptr-deref when device_add_disk() fails - block: fix zone write plugs refcount handling in disk_zone_wplug_schedule_bio_work() - io_uring/timeout: check unused sqe fields - iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() - io_uring/poll: fix signed comparison in io_poll_get_ownership() - io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE - ALSA: core: Fix potential data race at fasync handling - ALSA: caiaq: Fix control_put() result and cache rollback - ALSA: caiaq: Handle probe errors properly - ALSA: 6fire: Fix input volume change detection - ALSA: pcmtest: fix reference leak on failed device registration - ALSA: pcmtest: Fix resource leaks in module init error paths - iio: adc: ad7768-1: fix one-shot mode data acquisition - rxrpc: Fix memory leaks in rxkad_verify_response() - rxrpc: Fix rxkad crypto unalignment handling - rxrpc: Fix re-decryption of RESPONSE packets - tools/accounting: handle truncated taskstats netlink messages - arm64: dts: marvell: uDPU: add ethernet aliases - net: qrtr: ns: Free the node during ctrl_cmd_bye() - net: rds: fix MR cleanup on copy error - net: txgbe: fix firmware version check - net/smc: avoid early lgr access in smc_clc_wait_msg - net: ks8851: Reinstate disabling of BHs around IRQ handler - netconsole: avoid out-of-bounds access on empty string in trim_newline() - net: ks8851: Avoid excess softirq scheduling - drm/arcpgu: fix device node leak - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv - ipv4: icmp: validate reply type before using icmp_pointers - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() - extract-cert: Wrap key_pass with '#ifdef USE_PKCS11_ENGINE' - tpm: avoid -Wunused-but-set-variable - LoongArch: Show CPU vulnerabilites correctly - power: supply: axp288_charger: Do not cancel work before initializing it - hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() - randomize_kstack: Maintain kstack_offset per task - mmc: block: use single block write in retry - mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration - arm64: dts: ti: am62-verdin: Enable pullup for eMMC data pins - xfs: fix a resource leak in xfs_alloc_buftarg() - firmware: google: framebuffer: Do not unregister platform device - crypto: talitos - fix SEC1 32k ahash request limitation - crypto: talitos - rename first/last to first_desc/last_desc - pwm: imx-tpm: Count the number of enabled channels in probe - tpm: Fix auth session leak in tpm2_get_random() error path - tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() - tpm: tpm_tis: add error logging for data transfer - tpm: tpm_tis: stop transmit if retries are exhausted - rtc: ntxec: fix OF node reference imbalance - mm/damon/core: use time_in_range_open() for damos quota window start - userfaultfd: allow registration of ranges below mmap_min_addr - KVM: x86: Defer non-architectural deliver of exception payload to userspace read - KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state - KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 - KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts - KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode - KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXIT - KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN - KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) - KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT - KVM: nSVM: Clear tracking of L1->L2 NMI and soft IRQ on nested #VMEXIT - KVM: nSVM: Add missing consistency check for EFER, CR0, CR4, and CS - KVM: nSVM: Add missing consistency check for nCR3 validity - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 - KVM: nSVM: Always intercept VMMCALL when L2 is active - io_uring/poll: fix multishot recv missing EOF on wakeup race - perf annotate: Use jump__delete when freeing LoongArch jumps - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - mtd: spi-nor: sst: Fix write enable before AAI sequence - amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 - md/raid5: fix soft lockup in retry_aligned_read() - md/raid5: validate payload size before accessing journal metadata - check-uapi: link into shared objects - HID: apple: ensure the keyboard backlight is off if suspending - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails - x86/cpu: Disable FRED when PTI is forced on - wifi: rtl8xxxu: fix potential use of uninitialized value - tcp: call sk_data_ready() after listener migration - taskstats: set version in TGID exit notifications - mfd: core: Preserve OF node when ACPI handle is present - apparmor: use target task's context in apparmor_getprocattr() - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers - bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays - can: ucan: fix devres lifetime - crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit - crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup - crypto: atmel-ecc - Release client on allocation failure - crypto: hisilicon - Fix dma_unmap_single() direction - crypto: ccree - fix a memory leak in cc_mac_digest() - crypto: atmel-tdes - fix DMA sync direction - crypto: atmel-sha204a - Fix error codes in OTP reads - crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path - crypto: atmel-sha204a - Fix uninitialized data access on OTP read error - crypto: nx - Fix packed layout in struct nx842_crypto_header - dm mirror: fix integer overflow in create_dirty_log() - ceph: only d_add() negative dentries when they are unhashed - IB/core: Fix zero dmac race in neighbor resolution - ktest: Fix the month in the name of the failure directory - ntfs3: add buffer boundary checks to run_unpack() - ntfs3: fix integer overflow in run_unpack() volume boundary check - rtmutex: Use waiter::task instead of current in remove_waiter() - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails - seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode - smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709) - f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() (CVE-2026-31715) - lib: test_hmm: evict device pages on file close to avoid use-after-free - f2fs: fix to do sanity check on dcc->discard_cmd_cnt conditionally - ksmbd: use msleep instaed of schedule_timeout_interruptible() - ksmbd: replace connection list with hash table - ksmbd: reset rcount per connection in ksmbd_conn_wait_idle_sess_id() - thermal: core: Fix thermal zone governor cleanup issues - wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor - wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() - mm/migrate: factor out movable_ops page handling into migrate_movable_ops_page() - mm/migrate: move movable_ops page handling out of move_to_new_folio() - mm: migrate: requeue destination folio on deferred split queue - ALSA: aoa: Use guard() for mutex locks - ALSA: aoa: i2sbus: clear stale prepared state - mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() - media: rc: ttusbir: respect DMA coherency rules - ALSA: aoa: Skip devices with no codecs in i2sbus_resume() - media: rc: igorplugusb: heed coherency rules - RDMA/mana_ib: Disable RX steering on RSS QP destroy - block: relax pgmap check in bio_add_page for compatible zone device pages - iio: frequency: admv1013: add dev variable - iio: frequency: admv1013: fix NULL pointer dereference on str - rxrpc: Fix potential UAF after skb_unshare() failure - net: qrtr: ns: Limit the maximum server registration per node - net: qrtr: ns: Limit the maximum number of lookups - net: bridge: use a stable FDB dst snapshot in RCU readers - net: mctp: fix don't require received header reserved bits to be zero - net: qrtr: ns: Limit the total number of nodes - spi: fix resource leaks on device setup failure - mm: prevent droppable mappings from being locked - crypto: authencesn - reject short ahash digests during instance creation - net: bonding: fix use-after-free in bond_xmit_broadcast() (CVE-2026-31419) - driver core: Add kernel-doc for DEV_FLAG_COUNT enum value - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path - ALSA: caiaq: Don't abort when no input device is available - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows - drm/amdgpu: fix zero-size GDS range init on RDNA4 - ALSA: caiaq: fix usb_dev refcount leak on probe failure - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels - netfilter: reject zero shift in nft_bitwise [ Ben Hutchings ] * Fix ordering of kernel version strings for multiple Debian revisions (Closes: #1113728) * rxrpc: Fix conn-level packet handling to unshare RESPONSE packets [ Salvatore Bonaccorso ] * xfrm: esp: avoid in-place decrypt on shared skb frags * rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present -- Salvatore Bonaccorso Fri, 08 May 2026 08:54:02 +0200 linux (6.12.85-1~bpo12+1) bookworm-backports; urgency=high * Rebuild for bookworm-backports -- Ben Hutchings Fri, 01 May 2026 00:04:44 +0200 linux (6.12.85-1) trixie-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.75 - RDMA/siw: Fix potential NULL pointer dereference in header processing - RDMA/umad: Reject negative data_len in ib_umad_write - auxdisplay: arm-charlcd: fix release_mem_region() size - hfsplus: return error when node already exists in hfs_bnode_create - rcu: Refactor expedited handling check in rcu_read_unlock_special() - rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() - rcu: Fix rcu_read_unlock() deadloop due to softirq - audit: move the compat_xxx_class[] extern declarations to audit_arch.h - i3c: Move device name assignment after i3c_bus_init - fs: add for 'init_fs' - i3c: master: Update hot-join flag only on success - gfs2: Retries missing in gfs2_{rename,exchange} - gfs2: Fix slab-use-after-free in qd_put - gfs2: Fix use-after-free in iomap inline data write path - i3c: dw: Initialize spinlock to avoid upsetting lockdep - i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers() - tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure - tpm: st33zp24: Fix missing cleanup on get_burstcount() error - erofs: get rid of raw bi_end_io() usage - erofs: handle end of filesystem properly for file-backed mounts - btrfs: qgroup: return correct error when deleting qgroup relation item - btrfs: fix block_group_tree dirty_list corruption - smb: client: fix potential UAF and double free in smb2_open_file() - block: add a bio_add_virt_nofail helper - rnbd-srv: use bio_add_virt_nofail - rnbd-srv: Fix server side setting of bi_size for special IOs - xen/virtio: Don't use grant-dma-ops when running as Dom0 - io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() - io_uring/sync: validate passed in offset - cpuidle: governors: menu: Always check timers with tick stopped - thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature - md/raid5: fix raid5_run() to return error when log_init() fails - md/raid10: fix any_working flag handling in raid10_sync_request - OPP: Return correct value in dev_pm_opp_get_level - cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() - iomap: fix submission side handling of completion side errors - thermal/of: Fix reference leak in thermal_of_cm_lookup() - ublk: Validate SQE128 flag before accessing the cmd - Partial revert "x86/xen: fix balloon target initialization for PVH dom0" - md/raid1: fix memory leak in raid1_run() if no active rdev - md/raid1: fix memory leak in raid1_run() - PM: wakeup: Handle empty list in wakeup_sources_walk_start() - perf: arm_spe: Properly set hw.state on failures - cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible - PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races - [s390x] cio: Fix device lifecycle handling in css_alloc_subchannel() - [amd64] perf/x86/core: Do not set bit width for unavailable counters - crypto: qat - fix warning on adf_pfvf_pf_proto.c - libbpf: Fix OOB read in btf_dump_get_bitfield_value - [armhf] VDSO: Patch out __vdso_clock_getres() if unavailable - [arm64] crypto: cavium - fix dma_free_coherent() size - bpf: Preserve id of register in sync_linked_regs() - hrtimer: Fix trace oddity - [amd64] crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls - [amd64] crypto: ccp - narrow scope of snp_range_list - bpf, sockmap: Fix incorrect copied_seq calculation - bpf, sockmap: Fix FIONREAD for sockmap - tracing: Add a comment about ftrace_regs definition - ftrace: Make ftrace_regs abstract from direct use - ftrace: Consolidate ftrace_regs accessor functions for archs using pt_regs - ftrace: Use arch_ftrace_regs() for ftrace_regs_*() macros - ftrace: Rename ftrace_regs_return_value to ftrace_regs_get_return_value - fgraph: Replace fgraph_ret_regs with ftrace_regs - tracing: Add ftrace_partial_regs() for converting ftrace_regs to pt_regs - tracing: Add ftrace_fill_perf_regs() for perf event - [amd64] x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe - [amd64] x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path - [arm64] crypto: caam - fix netdev memory leak in dpaa2_caam_probe - bpf: Fix bpf_xdp_store_bytes proto for read-only arg - genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). - [amd64] platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() - Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler - scsi: efct: Use IRQF_ONESHOT and default primary handler - EDAC/altera: Remove IRQF_ONESHOT - mfd: wm8350-core: Use IRQF_ONESHOT - media: pci: mg4b: Use IRQF_NO_THREAD - sched/deadline: Clear the defer params - sched/rt: Skip currently executing CPU in rto_next_cpu() - hwrng: core - Allow runtime disabling of the HW RNG - hwrng: core - use RCU and work_struct to fix race condition - pstore/ram: fix buffer overflow in persistent_ram_save_old() - soc: qcom: smem: handle ENOMEM error during probe - EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() - EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() - firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET - [arm64] dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings - [arm64] dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings - [arm64] clk: qcom: Return correct error code in qcom_cc_probe_by_index() - [arm64] dts: qcom: sdm630: fix gpu_speed_bin size - [arm64] dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on - [arm64] dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on - [arm64] dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks - [arm64] dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 - [armhf] dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property - [powerpc*] uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() - [arm64] soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe - [arm64] soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() - [powerpc*] eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling - [arm64] dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node - [arm64] dts: amlogic: s4: assign mmc b clock to 24MHz - [arm64] dts: amlogic: s4: fix mmc clock assignment - [arm64] dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order - [arm64] dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4 - hwspinlock: omap: Handle devm_pm_runtime_enable() errors - [arm64] dts: amlogic: c3: assign the MMC signal clocks - [arm64] dts: amlogic: axg: assign the MMC signal clocks - [arm64] dts: amlogic: gx: assign the MMC signal clocks - [arm64] dts: amlogic: g12: assign the MMC B and C signal clocks - [arm64] dts: amlogic: g12: assign the MMC A signal clock - [arm64] dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm - [arm64] dts: qcom: sdm845-db845c: drop CS from SPIO0 - [arm64] dts: qcom: sdm845-db845c: specify power for WiFi CH1 - [arm64] dts: qcom: x1e: bus is 40-bits (fix 64GB models) - [arm64] dts: qcom: agatti: Add CX_MEM/DBGC GPU regions - [arm64] dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions - [arm64] drm/panthor: Recover from panthor_gpu_flush_caches() failures - [arm64] drm/panthor: Fix the full_tick check - [arm64] drm/panthor: Fix the group priority rotation logic - [arm64] drm/panthor: Fix immediate ticking on a disabled tick - [arm64] drm/panthor: Fix the logic that decides when to stop ticking - [arm64] drm/panthor: Make sure we resume the tick when new jobs are submitted - workqueue: Factor out assign_rescuer_work() - workqueue: Only assign rescuer work when really needed - workqueue: Process rescuer work items one-by-one using a cursor - drm/panel: sw43408: Remove manual invocation of unprepare at remove - ALSA: pcm: use new array-copying-wrapper - ALSA: pcm: Relax __free() variable declarations - ALSA: vmaster: Relax __free() variable declarations - [arm64] drm/panthor: Evict groups before VM termination - [amd64] ASoC: nau8821: Consistently clear interrupts before unmasking - [amd64] ASoC: nau8821: Avoid unnecessary blocking in IRQ handler - [amd64] ASoC: nau8821: Fixup nau8821_enable_jack_detect() - media: chips-media: wave5: Fix memory leak on codec_info allocation failure - drm/amd: Drop "amdgpu kernel modesetting enabled" message - drm/amdkfd: Fix signal_eviction_fence() bool return value - drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init - [arm64] drm/msm/disp/dpu: add merge3d support for sc7280 - [arm64] drm/msm/dpu: Set vsync source irrespective of mdp top support - [arm64] drm/msm/dpu: fix WD timer handling on DPU 8.x - regulator: core: move supply check earlier in set_machine_constraints() - HID: playstation: Add missing check for input_ff_create_memless - [arm64] drm/msm/disp: set num_planes to 1 for interleaved YUV formats - [arm64] drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x - media: ccs: Accommodate C-PHY into the calculation - [arm64] drm/msm/a2xx: fix pixel shader start on A225 - drm/buddy: release free_trees array on buddy mm teardown - platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev - media: uvcvideo: Fix allocation for small frame sizes - evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac() - drm/xe: Unregister drm device on probe error - platform/chrome: cros_ec_lightbar: Fix response size initialization - HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients - spi: tools: Add include folder to .gitignore - Revert "hwmon: (ibmpex) fix use-after-free in high/low store" - hwmon: pmbus: mpq8785: Prepare driver for multiple device support - hwmon: pmbus: mpq8785: Implement VOUT feedback resistor divider ratio configuration - hwmon: pmbus: mpq8785: Add support for MPM82504 - hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification - PCI: mediatek: Fix IRQ domain leak when MSI allocation fails - Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors - PCI/PM: Avoid redundant delays on D3hot->D3cold - wifi: cfg80211: Fix use_for flag update on BSS refresh - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails - docs: fix WARNING document not included in any toctree - Documentation: trace: Refactor toctree - Documentation: tracing: Add PCI tracepoint documentation - PCI: Do not attempt to set ExtTag for VFs - PCI/portdrv: Fix potential resource leak - dm: fix unlocked test for dm_suspended_md - dm: use READ_ONCE in dm_blk_report_zones - quota: fix livelock between quotactl and freeze_super - net: mctp-i2c: fix duplicate reception of old data - mctp i2c: initialise event handler read bytes - wifi: cfg80211: stop NAN and P2P in cfg80211_leave - netfilter: nf_tables: reset table validation state on abort - netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH - netfilter: nf_conncount: increase the connection clean up limit to 64 - netfilter: nft_compat: add more restrictions on netlink attributes - netfilter: nf_conncount: fix tracking of connections from localhost - module: add helper function for reading module_buildid() - kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() - PCI: Mark 3ware-9650SA Root Port Extended Tags as broken - [amd64] iommu/vt-d: Flush cache for PASID table before using it - [amd64] iommu/vt-d: Separate page request queue from SVM - [amd64] iommu/vt-d: Drain PRQs when domain removed from RID - [amd64] iommu/vt-d: Avoid draining PRQ in sva mm release path - [amd64] iommu/vt-d: Clear Present bit before tearing down PASID entry - dm: use bio_clone_blkg_association - xdrgen: Fix struct prefix for typedef types in program wrappers - NFS: NFSERR_INVAL is not defined by NFSv2 - xdrgen: Initialize data pointer for zero-length items - nfsd: never defer requests during idmap lookup - fat: avoid parent link count underflow in rmdir - tcp: tcp_tx_timestamp() must look at the rtx queue - PCI: Check parent for NULL in of_pci_bus_release_domain_nr() - wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() - PCI: Initialize RCB from pci_configure_device() - PCI: Add defines for bridge window indexing - PCI/ACPI: Restrict program_hpx_type2() to AER bits - ipc: don't audit capability check in ipc_permissions() - ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() - mptcp: fix receive space timestamp initialization - octeontx2-af: Fix PF driver crash with kexec kernel booting - bonding: only set speed/duplex to unknown, if getting speed failed - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP - nfc: hci: shdlc: Stop timers and work before freeing context - netfilter: nfnetlink_queue: optimize verdict lookup with hash table - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation - netfilter: nft_set_hash: fix get operation on big endian - netfilter: nft_counter: fix reset of counters on 32bit archs - netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets - PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] - [arm64] net: hns3: fix double free issue for tx spare buffer - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - smb: client: correct value for smbd_max_fragmented_recv_size - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() - net: sunhme: Fix sbus regression - net: Add skb_dstref_steal and skb_dstref_restore - net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers - xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path - serial: caif: fix use-after-free in caif_serial ldisc_close() - octeon_ep: disable per ring interrupts - octeon_ep: ensure dbell BADDR updation - octeon_ep_vf: ensure dbell BADDR updation - ionic: Rate limit unknown xcvr type messages - octeontx2-pf: Unregister devlink on probe failure - RDMA/rtrs: server: remove dead code - IB/cache: update gid cache on client reregister event - RDMA/hns: Fix WQ_MEM_RECLAIM warning - RDMA/hns: Fix RoCEv1 failure due to DSCP - RDMA/hns: Notify ULP of remaining soft-WCs during reset - power: supply: ab8500: Fix use-after-free in power_supply_changed() - power: supply: act8945a: Fix use-after-free in power_supply_changed() - power: supply: bq256xx: Fix use-after-free in power_supply_changed() - power: supply: bq25980: Fix use-after-free in power_supply_changed() - power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() - power: supply: goldfish: Fix use-after-free in power_supply_changed() - power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() - power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() - power: supply: rt9455: Fix use-after-free in power_supply_changed() - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() - power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write - power: supply: bq27xxx: fix wrong errno when bus ops are unsupported - power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() - RDMA/rtrs-srv: fix SG mapping - RDMA/rxe: Fix double free in rxe_srq_from_init - RDMA/iwcm: Fix workqueue list corruption by removing work_list - tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() - RDMA/mlx5: Fix UMR hang in LAG error state unload - IB/mlx5: Fix port speed query for representors - mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper - vfio/pci: Lock upstream bridge for vfio_pci_core_disable() - [amd64] platform/x86/amd/pmf: Prevent TEE errors after hibernate - [amd64] crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails - [amd64] crypto: ccp - Add an S4 restore flow - [amd64] crypto: ccp - Factor out ring destroy handling to a helper - [amd64] crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails - mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() - nfs/localio: eliminate unnecessary kref in nfs_local_fsync_ctx - NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler - RDMA/rxe: Fix race condition in QP timer handlers - RDMA/core: add rdma_rw_max_sge() helper for SQ sizing - cxl: Fix premature commit_end increment on decoder commit failure - mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() - mtd: spinand: Fix kernel doc - power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler - power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer - RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() - scsi: ufs: host: mediatek: Require CONFIG_PM - scsi: csiostor: Fix dereference of null pointer rn - nvdimm: virtio_pmem: serialize flush requests - fs/nfs: Fix readdir slow-start regression - tracing: Properly process error handling in event_hist_trigger_parse() - tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros - fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() - fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() - clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs - clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs - clk: qcom: rcg2: compute 2d using duty fraction directly - clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs - clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops - clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc - clk: qcom: gcc-ipq5018: flag sleep clock as critical - clk: Move clk_{save,restore}_context() to COMMON_CLK section - clk: qcom: dispcc-sdm845: Enable parents for pixel clocks - clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src - clk: qcom: gfx3d: add parent to parent request map - clk: mediatek: Fix error handling in runtime PM setup - interconnect: mediatek: Don't hijack parent device - interconnect: mediatek: Aggregate bandwidth with saturating add - dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX - dma: dma-axi-dmac: fix SW cyclic transfers - dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue - soundwire: intel_ace2x: add SND_HDA_CORE dependency - iio: test: drop dangling symbol in gain-time-scale helpers - staging: greybus: lights: avoid NULL deref - serial: imx: change SERIAL_IMX_CONSOLE to bool - serial: SH_SCI: improve "DMA support" prompt - mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms - iio: pressure: mprls0025pa: fix spi_transfer struct initialisation - iio: pressure: mprls0025pa: fix SPI CS delay violation - iio: pressure: mprls0025pa: fix interrupt flag - iio: pressure: mprls0025pa: fix scan_type struct - iio: pressure: mprls0025pa: fix pressure calculation - watchdog: starfive-wdt: Fix PM reference leak in probe error path - coresight: etm3x: Fix cpulocked warning on cpuhp - phy: freescale: imx8qm-hsio: fix NULL pointer dereference - Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" - mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure - mfd: simple-mfd-i2c: Add MAX77705 support - mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA - mfd: simple-mfd-i2c: Add SpacemiT P1 support - mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order - mfd: simple-mfd-i2c: Add Delta TN48M CPLD support - drivers: iio: mpu3050: use dev_err_probe for regulator request - usb: bdc: fix sleep during atomic - pinctrl: equilibrium: Fix device node reference leak in pinbank_init() - ovl: Fix uninit-value in ovl_fill_real - iio: sca3000: Fix a resource leak in sca3000_probe() - pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition - pinctrl: single: fix refcount leak in pcs_add_gpio_func() - leds: qcom-lpg: Check the return value of regmap_bulk_write() - backlight: qcom-wled: Support ovp values for PMI8994 - backlight: qcom-wled: Change PM8950 WLED configurations - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() - drbd: always set BLK_FEAT_STABLE_WRITES - io_uring/cancel: de-unionize file and user_data in struct io_cancel_data - fs/ntfs3: Initialize new folios before use - fs/ntfs3: prevent infinite loops caused by the next valid being the same - fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot - ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs - powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check - kbuild: Add objtool to top-level clean target - objpool: fix the overestimation of object pooling metadata size - ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO - cpuidle: Skip governor when only one idle state is available - net: sparx5/lan969x: fix DWRR cost max to match hardware register width - net: mscc: ocelot: extract ocelot_xmit_timestamp() helper - net: mscc: ocelot: split xmit into FDMA and register injection paths - net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() - ipv6: Fix out-of-bound access in fib6_add_rt2node(). - net: sparx5/lan969x: fix PTP clock max_adj value - net: usb: catc: enable basic endpoint checking - xen-netback: reject zero-queue configuration from guest - net/rds: rds_sendmsg should not discard payload_len - net: bridge: mcast: always update mdb_n_entries for vlan contexts - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value - ipvs: do not keep dest_dst if dev is going down - net: remove WARN_ON_ONCE when accessing forward path array - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CVE-2026-23231) - ipv6: fix a race in ip6_sock_set_v6only() - bpftool: Fix truncated netlink dumps - ping: annotate data-races in ping_lookup() - macvlan: observe an RCU grace period in macvlan_common_newlink() error path - icmp: prevent possible overflow in icmp_global_allow() - inet: move icmp_global_{credit,stamp} to a separate cache line - octeontx2-af: Fix default entries mcam entry action - bonding: alb: fix UAF in rlb_arp_recv during bond up/down - net/mlx5: Fix multiport device check over light SFs - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels - apparmor: fix NULL sock in aa_sock_file_perm - AppArmor: Allow apparmor to handle unaligned dfa tables - apparmor: Fix & Optimize table creation from possibly unaligned memory - apparmor: return -ENOMEM in unpack_perms_table upon alloc failure - apparmor: fix rlimit for posix cpu timers - apparmor: remove apply_modes_to_perms from label_match - apparmor: make label_match return a consistent value - apparmor: avoid per-cpu hold underflow in aa_get_buffer - apparmor: fix invalid deref of rawdata when export_binary is unset - apparmor: fix aa_label to return state from compount and component match - drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() - drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges() - drm/amdgpu: Fix memory leak in amdgpu_ras_init() - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() - [amd64] drm/i915/acpi: free _DSM package when no connectors - ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 - drm/amd/display: Reject cursor plane on DCE when scaled differently than primary - drm/amd/display: Fix out-of-bounds stream encoder index v3 - spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() - [s390x] kexec: Make KEXEC_SIG available when CONFIG_MODULES=n - drm/xe: Move forcewake to 'gt.pm' substructure - drm/xe: Create dedicated xe_mmio structure - drm/xe: Clarify size of MMIO region - drm/xe: Move GSI offset adjustment fields into 'struct xe_mmio' - drm/xe: Populate GT's mmio iomap from tile during init - drm/xe: Switch mmio_ext to use 'struct xe_mmio' - drm/xe: Add xe_tile backpointer to xe_mmio - drm/xe: Adjust mmio code to pass VF substructure to SRIOV code - drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt - drm/xe/mmio: Avoid double-adjust in 64-bit reads - drm/xe/ptl: Apply Wa_13011645652 - drm/xe/xe2_hpg: Add set of workarounds - drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138 - efi: Fix reservation of unaccepted memory table - btrfs: use the correct type to initialize block reserve for delayed refs - btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found - [amd64] x86/hyperv: Fix error pointer dereference - [arm64] ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk - drm/amd/display: Use same max plane scaling limits for all 64 bpp formats - ext4: subdivide EXT4_EXT_DATA_VALID1 - ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 - ext4: don't cache extent during splitting extent - ext4: drop extent cache after doing PARTIAL_VALID1 zeroout - ext4: drop extent cache when splitting extent fails - ext4: fix memory leak in ext4_ext_shift_extents() - ext4: fix e4b bitmap inconsistency reports - ext4: fix dirtyclusters double decrement on fs shutdown - ext4: use optimized mballoc scanning regardless of inode format - ata: pata_ftide010: Fix some DMA timings - ata: libata-scsi: refactor ata_scsi_translate() - Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path - dt-bindings: phy: qcom-edp: Add missing clock for X Elite - ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false - ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names - ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names - perf test stat: Update test expectations and events - perf test stat tests: Fix for virtualized machines - perf unwind-libdw: Fix invalid reference counts - perf callchain: Fix srcline printing with inlines - libsubcmd: Fix null intersection case in exclude_cmds() - perf maps: Fix reference count leak in maps__find_ams() - perf annotate: Fix memcpy size in arch__grow_instructions() - perf vendor events amd: Fix Zen 5 MAB allocation events - libperf: Don't remove -g when EXTRA_CFLAGS are used - libperf build: Always place libperf includes first - rtc: interface: Alarm race handling should not discard preceding error - statmount: permission check should return EPERM - audit: add fchmodat2() to change attributes class - hfsplus: fix volume corruption issue for generic/498 - fs/buffer: add alert in try_to_free_buffers() for folios without buffers - audit: add missing syscalls to read class - hfsplus: pretend special inodes as regular files - i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() - i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init - minix: Add required sanity checking to minix_check_superblock() - dlm: validate length in dlm_search_rsb_tree - btrfs: fallback to buffered IO if the data profile has duplication - btrfs: handle user interrupt properly in btrfs_trim_fs() - smb: client: add proper locking around ses->iface_last_update - gfs2: fiemap page fault fix - smb: client: prevent races in ->query_interfaces() - tools/power cpupower: Reset errno before strtoull() - [s390x] purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS - [arm64] Add support for TSV110 Spectre-BHB mitigation - rnbd-srv: Zero the rsp buffer before using it - [amd64] x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set - EFI/CPER: don't dump the entire memory region - APEI/GHES: ensure that won't go past CPER allocated record - APEI/GHES: ARM processor Error: don't go past allocated memory - EFI/CPER: don't go past the ARM processor CPER record buffer - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() - ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] - ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP - powercap: intel_rapl: Add PL4 support for Ice Lake - alpha: fix user-space corruption during memory compaction - md-cluster: fix NULL pointer dereference in process_metadata_update - cpufreq: dt-platdev: Block the driver from probing on more QC platforms - [s390x] perf: Disable register readout on sampling events - perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD - ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) - ACPI: battery: fix incorrect charging status when current is zero - xenbus: Use .freeze/.thaw to handle xenbus devices - blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() - block: decouple secure erase size limit from discard size limit - bpf: verifier improvement in 32bit shift sign extension pattern - [amd64] perf/x86/msr: Add Airmont NP - [amd64] perf/x86/cstate: Add Airmont NP - bpf: crypto: Use the correct destructor kfunc type - bpf: Recognize special arithmetic shift in the verifier - clocksource/drivers/sh_tmu: Always leave device running after probe - clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF - PCI/MSI: Unmap MSI-X region on error - crypto: hisilicon/qm - move the barrier before writing to the mailbox register - mailbox: bcm-ferxrm-mailbox: Use default primary handler - char: tpm: cr50: Remove IRQF_ONESHOT - sched/debug: Fix updating of ppos on server write ops - pstore: ram_core: fix incorrect success return when vmap() fails - firmware: arm_ffa: Unmap Rx/Tx buffers on init failure - [arm64] Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" - [arm64] tegra: smaug: Add usb-role-switch support - drm/display/dp_mst: Add protection against 0 vcpi - gpu/panel-edp: add AUO panel entry for B140HAN06.4 - drm/amdgpu: fix NULL pointer issue buffer funcs - drm/amdkfd: Handle GPU reset and drain retry fault race - spi-geni-qcom: initialize mode related registers to 0 - spi-geni-qcom: use xfer->bits_per_word for can_dma() - drm/amd/display: Add USB-C DP Alt Mode lane limitation in DCN32 - [amd64] ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET - media: dvb-core: dmxdevfilter must always flush bufs - spi: stm32: fix Overrun issue at < 8bpw - drm/v3d: Set DMA segment size to avoid debug warnings - media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes - media: omap3isp: isppreview: always clamp in preview_try_format() - media: omap3isp: set initial format - media: chips-media: wave5: Fix conditional in start_streaming - media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder - media: mediatek: vcodec: Don't try to decode 422/444 VP9 - drm/amdgpu: add support for HDP IP version 6.1.1 - drm/amd/display: Fix dsc eDP issue - drm/amdgpu: avoid a warning in timedout job handler - drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src - HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards - drm/amdgpu: Skip loading SDMA_RS64 in VF - drm/amd/display: only power down dig on phy endpoints - drm/xe: Only toggle scheduling in TDR if GuC is running - ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask - ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug - spi: spi-mem: Limit octal DTR constraints to octal DTR situations - media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START - drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() - media: adv7180: fix frame interval in progressive mode - media: pvrusb2: fix URB leak in pvr2_send_request_ex - media: solo6x10: Check for out of bounds chip_id - media: cx25821: Fix a resource leak in cx25821_dev_setup() - media: v4l2-async: Fix error handling on steps after finding a match - media: mt9m114: Avoid a reset low spike during probe() - media: mt9m114: Return -EPROBE_DEFER if no endpoint is found - media: ipu6: Ensure stream_mutex is acquired when dealing with node list - media: ipu6: Close firmware streams on streaming enable failure - media: ipu6: Always close firmware stream - ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk - drm/amdkfd: Relax size checking during queue buffer get - drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() - drm: Account property blob allocations to memcg - hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed - virt: vbox: uapi: Mark inner unions in packed structs as packed - [amd64] ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated - PCI: Add Intel Nova Lake audio Device ID - drm/amd/display: Disable FEC when powering down encoders - drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback - drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release - media: rkisp1: Fix filter mode register configuration - HID: multitouch: add eGalaxTouch EXC3188 support - HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK - ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro - ALSA: hda/realtek: fix LG Gram Style 14 speakers - gpio: aspeed-sgpio: Change the macro to support deferred probe - [arm64] ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio - spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end - drm/amd/display: Fix GFX12 family constant checks - drm/amd/display: avoid dig reg access timeout on usb4 link training fail - ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() - hwmon: (dell-smm) Add support for Dell OptiPlex 7080 - hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE - hwmon: (f71882fg) Add F81968 support - HID: logitech-hidpp: Add support for Logitech K980 - ASoC: es8328: Add error unwind in resume - modpost: Amend ppc64 save/restfpr symnames for -Os build - power: sequencing: fix missing state_lock in pwrseq_power_on() error path - [amd64] ASoC: SOF: Intel: hda: Fix NULL pointer dereference - spi: geni-qcom: Fix abort sequence execution for serial engine errors - ASoC: fsl: imx-rpmsg: use snd_soc_find_dai_with_mutex() in probe - ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx - ALSA: mixer: oss: Add card disconnect checkpoints - ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio - jfs: Add missing set_freezable() for freezable kthread - jfs: nlink overflow in jfs_rename - wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() - wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H - wifi: rtw89: 8922a: set random mac if efuse contains zeroes - wifi: rtw89: ser: enable error IMR after recovering from L1 - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() - wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data - dm: replace -EEXIST with -EBUSY - dm: remove fake timeout to avoid leak request - [arm64] iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency - net: wwan: mhi: Add network support for Foxconn T99W760 - wifi: libertas: fix WARNING in usb_tx_block - [amd64] iommu/amd: move wait_on_sem() out of spinlock - wifi: rtw89: mac: correct page number for CSI response - wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode - wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 - wifi: ath11k: Fix failure to connect to a 6 GHz AP - wifi: ath12k: fix preferred hardware mode calculation - wifi: cfg80211: allow only one NAN interface, also in multi radio - ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() - ipv6: annotate data-races over sysctl.flowlabel_reflect - ipv6: exthdrs: annotate data-race over multiple sysctl - ext4: mark group add fast-commit ineligible - ext4: move ext4_percpu_param_init() before ext4_mb_init() - ext4: mark group extend fast-commit ineligible - ext4: use reserved metadata blocks when splitting extent on endio - netfilter: nf_conntrack: Add allow_clash to generic protocol handler - netfilter: xt_tcpmss: check remaining length before reading optlen - net: usb: r8152: fix transmit queue timeout - wifi: iwlwifi: mvm: check the validity of noa_len - wifi: rtw89: fix unable to receive probe responses under MLO connection - wifi: rtw89: 8922a: add digital compensation for 2GHz - net/rds: No shortcut out of RDS_CONN_ERROR - ext4: propagate flags to convert_initialized_extent() - gro: change the BUG_ON() in gro_pull_from_frag0() - ipv4: igmp: annotate data-races around idev->mr_maxdelay - [arm64] net: hns3: extend HCLGE_FD_AD_QID to 11 bits - wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() - wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() - ipv4: fib: Annotate access to struct fib_alias.fa_state. - Bluetooth: btusb: Add support for MediaTek7920 0489:e158 - Bluetooth: hci_conn: Set link_policy on incoming ACL connections - Bluetooth: hci_conn: use mod_delayed_work for active mode timeout - Bluetooth: btusb: Add new VID/PID for RTL8852CE - Bluetooth: btusb: Add device ID for Realtek RTL8761BU - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky - net: sfp: add quirk for Lantech 8330-265D - wifi: rtw89: pci: restore LDO setting after device resume - wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() - bnxt_en: Allow ntuple filters for drops - net: usb: sr9700: remove code to drive nonexistent multicast filter - vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 - net/rds: Clear reconnect pending bit - PCI: Mark ASM1164 SATA controller to avoid bus reset - PCI/AER: Clear stale errors on reporting agents upon probe - PCI: Fix pci_slot_lock () device locking - PCI: Enable ACS after configuring IOMMU for OF platforms - PCI: Add ACS quirk for Qualcomm Hamoa & Glymur - PCI: Mark Nvidia GB10 to avoid bus reset - myri10ge: avoid uninitialized variable use - nfc: nxp-nci: remove interrupt trigger type - RDMA/rtrs-clt: For conn rejection use actual err number - ata: libata: avoid long timeouts on hot-unplugged SATA DAS - hisi_acc_vfio_pci: update status after RAS error - scsi: buslogic: Reduce stack usage - vhost: fix caching attributes of MMIO regions by setting them explicitly - scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event - [riscv64] vector: init vector context with proper vlenb - tracing: Fix false sharing in hwlat get_sample() - remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized - mailbox: pcc: Remove spurious IRQF_ONESHOT usage - mailbox: imx: Skip the suspend flag for i.MX7ULP - mailbox: sprd: mask interrupts that are not handled - remoteproc: mediatek: Break lock dependency to `prepare_lock` - mailbox: sprd: clear delivery flag before handling TX done - clk: microchip: core: correct return value on *_get_parent() - HID: i2c-hid: Add FocalTech FT8112 - 9p/xen: protect xen_9pfs_front_free against concurrent calls - dmaengine: stm32-dma3: use module_platform_driver - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list - staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure - serial: 8250_dw: handle clock enable errors in runtime_resume - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs - fpga: of-fpga-region: Fail if any bridge is missing - most: core: fix resource leak in most_register_interface error paths - dmaengine: sun6i: Choose appropriate burst length under maxburst - dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings - phy: ti: phy-j721e-wiz: restore mux selection during resume - phy: cadence-torrent: restore parent clock for refclk during resume - misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() - misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 - usb: gadget: f_fs: fix DMA-BUF OUT queues - usb: gadget: f_fs: Fix ioctl error handling - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() - staging: rtl8723bs: fix memory leak on failure path - serial: 8250: 8250_omap.c: Add support for handling UART error conditions - serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done - fix it87_wdt early reboot by reporting running timer - [arm*] binder: don't use %pK through printk - watchdog: imx7ulp_wdt: handle the nowayout option - phy: mvebu-cp110-utmi: fix dr_mode property read from dts - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature - Revert "mfd: da9052-spi: Change read-mask to write-mask" - mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs - iio: Use IRQF_NO_THREAD - iio: magnetometer: Remove IRQF_ONESHOT - fs: ntfs3: check return value of indx_find to avoid infinite loop - fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata - fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST - fs/ntfs3: drop preallocated clusters for sparse and compressed files - fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() - ceph: supply snapshot context in ceph_uninline_data() - libceph: define and enforce CEPH_MAX_KEY_LEN - thermal: int340x: Fix sysfs group leak on DLVR registration failure - [amd64] ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 - include: uapi: netfilter_bridge.h: Cover for musl libc - drm/amd/display: Fix writeback on DCN 3.2+ - drm/amd/display: Fix system resume lag issue - drm/amd/display: Avoid updating surface with the same surface under MPO - drm/amdgpu: Adjust usleep_range in fence wait - ALSA: usb-audio: Update the number of packets properly at receiving - drm/amdgpu: Add HAINAN clock adjustment - drm/amd/display: bypass post csc for additional color spaces in dal - spi: spidev: fix lock inversion between spi_lock and buf_lock - drm/radeon: Add HAINAN clock adjustment - ALSA: usb-audio: Add sanity check for OOB writes at silencing - btrfs: replace BUG() with error handling in __btrfs_balance() - [arm64] hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) - drm/amd/display: Remove conditional for shaper 3DLUT power-on - rtc: zynqmp: correct frequency value - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() - xfrm: skip templates check for packet offload tunnel mode - ipmi: ipmb: initialise event handler read bytes - xfrm: always flush state and policy upon NETDEV_UNREGISTER event - espintcp: Fix race condition in espintcp_close() (CVE-2026-23239) - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode - net: usb: lan78xx: scan all MDIO addresses on LAN7801 - net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() - net: ethernet: xscale: Check for PTP support properly - bnxt_en: Fix RSS context delete logic - bnxt_en: Fix deleting of Ntuple filters - wifi: cfg80211: wext: fix IGTK key ID off-by-one - Remove WARN_ALL_UNSEEDED_RANDOM kernel config option - Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ - Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short - Bluetooth: hci_qca: Cleanup on all setup failures - Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ - tls: Fix race condition in tls_sw_cancel_work_tx() (CVE-2026-23240) - kcm: fix zero-frag skb in frag_list on partial sendmsg error - tipc: fix duplicate publication key in tipc_service_insert_publ() - RDMA/core: Fix stale RoCE GIDs during netdev events at registration - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets - RDMA/efa: Fix typo in efa_alloc_mr() - net: usb: pegasus: enable basic endpoint checking - RDMA/umem: Fix double dma_buf_unpin in failure path - net/mlx5: DR, Fix circular locking dependency in dump - net/mlx5: E-switch, Clear legacy flag when moving to switchdev - net/mlx5: Fix missing devlink lock in SRIOV enable error path - net/mlx5e: Separate address related variables to be in struct - net/mlx5e: Support routed networks during IPsec MACs initialization - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query - net: consume xmit errors of GSO frames - dpaa2-switch: validate num_ifs to prevent out-of-bounds write - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() - rpmsg: core: fix race in driver_override_show() and use core helper - [arm64] clk: renesas: rzg2l: Fix intin variable size - [arm64] clk: renesas: rzg2l: Select correct div round macro - [amd64] ASoC: SOF: ipc4-control: If there is no data do not send bytes update - [amd64] ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls - [amd64] ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data - [amd64] ASoC: SOF: ipc4-control: Keep the payload size up to date - fpga: dfl: use subsys_initcall to allow built-in drivers to be added - Revert "PCI: qcom: Enable MSI interrupts together with Link up if 'Global IRQ' is supported" - phy: qcom: edp: Make the number of clocks flexible - dm-verity: correctly handle dm_bufio_client_create() failure - media: mediatek: encoder: Fix uninitialized scalar variable issue - media: mtk-mdp: Fix error handling in probe function - media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() - media: chips-media: wave5: Fix kthread worker destruction in polling mode - media: chips-media: wave5: Fix device cleanup order to prevent kernel panic - media: verisilicon: AV1: Fix enable cdef computation - media: verisilicon: AV1: Fix tx mode bit setting - [arm64] dts: qcom: x1e80100: Add missing TCSR ref clock to the DP PHYs - [armhf] omap2: Fix reference count leaks in omap_control_init() - [amd64] KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR - [amd64] KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding - [arm64] Disable branch profiling for all arm64 code - HID: hid-pl: handle probe errors - HID: magicmouse: Do not crash on missing msc->input - HID: prodikeys: Check presence of pm->input_ep82 - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() - [arm64] dts: apple: t8112-j473: Keep the HDMI port powered on - media: amphion: Drop min_queued_buffers assignment - media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() - media: verisilicon: AV1: Set IDR flag for intra_only frame type - media: radio-keene: fix memory leak in error path - media: cx88: Add missing unmap in snd_cx88_hw_params() - media: cx23885: Add missing unmap in snd_cx23885_hw_params() - media: cx25821: Add missing unmap in snd_cx25821_hw_params() - media: i2c/tw9903: Fix potential memory leak in tw9903_probe() - media: i2c/tw9906: Fix potential memory leak in tw9906_probe() - media: i2c: ov01a10: Fix the horizontal flip control - media: i2c: ov01a10: Fix reported pixel-rate value - media: i2c: ov01a10: Fix analogue gain range - media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls - media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() - media: i2c: ov01a10: Fix test-pattern disabling - media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() - media: ccs: Avoid possible division by zero - media: i2c: ov5647: Initialize subdev before controls - media: i2c: ov5647: Correct pixel array offset - media: i2c: ov5647: Correct minimum VBLANK value - media: i2c: ov5647: Sensor should report RAW color space - media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode - media: ccs: Fix setting initial sub-device state - media: i2c: ov5647: use our own mutex for the ctrl lock - media: ipu6: Fix typo and wrong constant in ipu6-mmu.c - media: ipu6: Fix RPM reference leak in probe error paths - [amd64] platform/x86: ISST: Add missing write block check - dm-integrity: fix a typo in the code for write/discard race - dm: clear cloned request bio pointer when last clone bio completes - [arm64] soc: ti: k3-socinfo: Fix regmap leak on probe failure - [arm64] soc: ti: pruss: Fix double free in pruss_clk_mux_setup() - [amd64] KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation - bus: omap-ocp2scp: fix OF populate on driver rebind - clk: clk-apple-nco: Add "apple,t8103-nco" compatible - [arm64,armhf] soc: rockchip: grf: Fix wrong RK3576_IOCGRF_MISC_CON definition - [arm64,armhf] soc: rockchip: grf: Support multiple grf to be handled - media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop - media: i2c: ov01a10: Fix digital gain range - clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() - [s390x] pci: Handle futile config accesses of disabled devices directly - reset: gpio: suppress bind attributes in sysfs - dm-integrity: fix recalculation in bitmap mode - dm-unstripe: fix mapping bug when there are multiple targets in a table - [arm64] dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro - media: venus: vdec: fix error state assignment for zero bytesused - media: venus: vdec: restrict EOS addr quirk to IRIS2 only - drm: of: drm_of_panel_bridge_remove(): fix device_node leak - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs - drm/buddy: Prevent BUG_ON by validating rounded allocation - drm/bridge: anx7625: Fix invalid EDID size - xfs: mark data structures corrupt on EIO and ENODATA - xfs: remove xfs_attr_leaf_hasname - media: verisilicon: AV1: Fix tile info buffer size - [amd64] iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode - mfd: core: Add locking around 'mfd_of_node_list' - mfd: qcom-pm8xxx: Fix OF populate on driver rebind - mfd: omap-usb-host: Fix OF populate on driver rebind - iio: accel: adxl380: Avoid reading more entries than present in FIFO - xfs: delete attr leaf freemap entries when empty - xfs: fix freemap adjustments when adding xattrs to leaf blocks - xfs: fix the xattr scrub to detect freemap/entries array collisions - xfs: fix remote xattr valuelblk check - [amd64] KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() - PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions - pinctrl: intel: Add code name documentation - xfs: only call xf{array,blob}_destroy if we have a valid pointer - xfs: check return value of xchk_scrub_create_subord - xfs: check for deleted cursors when revalidating two btrees - md/bitmap: fix GPF in write_page caused by resize race - nfsd: fix return error code for nfsd_map_name_to_[ug]id - nvmem: Drop OF node reference on nvmem_add_one_cell() failure - [amd64] x86/kexec: add a sanity check on previous kernel's ima kexec buffer - mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN - io_uring/net: don't continue send bundle if poll was required for retry - bus: fsl-mc: fix an error handling in fsl_mc_device_add() - dm mpath: make pg_init_delay_msecs settable - [arm64] poe: fix stale POR_EL0 values for ptrace - tools: Fix bitfield dependency failure - vhost: move vdpa group bound check to vhost_vdpa - [powerpc*] smp: Add check for kcalloc() failure in parse_thread_groups() - iio: gyro: itg3200: Fix unchecked return value in read_raw - mtd: spinand: Disable continuous read during probe - mm/highmem: fix __kmap_to_page() build error - rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() - ocfs2: fix reflink preserve cleanup issue - kexec: derive purgatory entry from symbol - Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug - [arm64] Fix non-atomic __READ_ONCE() with CONFIG_LTO=y - clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 - btrfs: continue trimming remaining devices on failure - remoteproc: imx_rproc: Fix invalid loaded resource table detection - perf/arm-cmn: Reject unsupported hardware configurations - scsi: ufs: core: Flush exception handling work when RPM level is zero - mm/slab: use unsigned long for orig_size to ensure proper metadata align - PCI: dwc: Fix msg_atu_index assignment - usb: dwc3: gadget: Move vbus draw to workqueue context - usb: dwc2: fix resume failure if dr_mode is host - mtd: rawnand: pl353: Fix software ECC support - tipc: fix RCU dereference race in tipc_aead_users_dec() - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() - net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path - PCI: Fix pci_slot_trylock() error handling - staging: rtl8723bs: fix null dereference in find_network - kcsan, compiler_types: avoid duplicate type issues in BPF Type Format - watchdog/softlockup: fix sample ring index wrap in need_counting_irqs() - cifs: Fix locking usage for tcon fields - ceph: supply snapshot context in ceph_zero_partial_object() - rust: kbuild: pass `-Zunstable-options` for Rust 1.95.0 - net: ethernet: marvell: skge: remove incorrect conflicting PCI ID - net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() - octeontx2-af: CGX: fix bitmap leaks - net: ti: icssg-prueth: Add optional dependency on HSR - net: macb: Fix tx/rx malfunction after phy link down and up - tracing: Fix to set write permission to per-cpu buffer_size_kb - io_uring/filetable: clamp alloc_hint to the configured alloc range - drm/amd/display: Increase DCN35 SR enter/exit latency - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify - procfs: fix possible double mmput() in do_procmap_query() - net: intel: fix PCI device ID conflict between i40e and ipw2200 - atm: fore200e: fix use-after-free in tasklets during device removal - function_graph: Restore direct mode when callbacks drop to one - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() - mm: numa_memblks: Identify the accurate NUMA ID of CFMW - fbcon: check return value of con2fb_acquire_newinfo() - fbdev: vt8500lcdfb: fix missing dma_free_coherent() - fbdev: of: display_timing: fix refcount leak in of_get_display_timings() - fbdev: ffb: fix corrupted video output on Sun FFB1 - fbcon: Remove struct fbcon_display.inverse - cifs: some missing initializations on replay - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle - net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() - [amd64] x86/kexec: Copy ACPI root pointer address from config table - [arm64] Force the use of CNTVCT_EL0 in __delay() - drm/amdgpu: keep vga memory on MacBooks with switchable graphics - net: nfc: nci: Fix parameter validation for packet data - tracing: ring-buffer: Fix to check event length before using - fgraph: Do not call handlers direct when not using ftrace_ops - tracing: Fix checking of freed trace_event_file for hist files - tracing: Wake up poll waiters for hist files when removing an event - NTB: ntb_transport: Fix too small buffer for debugfs_name - ALSA: pcm: Revert bufs move in snd_pcm_xfern_frames_ioctl() - [amd64] drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros - xfs: fix copy-paste error in previous fix - [arm64] Fix sampling the "stable" virtual counter in preemptible section https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.76 - Revert "x86/kexec: add a sanity check on previous kernel's ima kexec buffer" https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.77 - drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions - drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() - [arm64] KVM: arm64: Hide S1POE from guests when not supported by the host - [riscv64] irqchip/sifive-plic: Fix frozen interrupt due to affinity setting - scsi: lpfc: Properly set WC for DPP mapping - scsi: pm8001: Fix use-after-free in pm8001_queue_command() - ALSA: scarlett2: Fix redeclaration of loop variable - ALSA: scarlett2: Fix DSP filter control array handling - ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices - [amd64] x86/fred: Correct speculative safety in fred_extint() - rseq: Clarify rseq registration rseq_size bound check comment - cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in update_cpumasks_hier() - scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume - ALSA: usb-audio: Cap the packet size pre-calculations - ALSA: usb-audio: Use inclusive terms - perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - [s390x] idle: Fix cpu idle exit cpu time accounting - [s390x] vtime: Fix virtual timer forwarding - PCI: endpoint: Introduce pci_epc_function_is_valid() - PCI: endpoint: Introduce pci_epc_mem_map()/unmap() - [arm64] PCI: dwc: endpoint: Implement the pci_epc_ops::align_addr() operation - [arm64] PCI: dwc: ep: Use align addr function for dw_pcie_ep_raise_{msi,msix}_irq() - [arm64] PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry - drm/amdgpu: Unlock a mutex before destroying it - drm/amdgpu: Replace kzalloc + copy_from_user with memdup_user - drm/amdgpu: Fix locking bugs in error paths - ALSA: pci: hda: use snd_kcontrol_chip() - ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put() - btrfs: fix incorrect key offset in error message in check_dev_extent_item() - btrfs: fix objectid value in error message in check_extent_data_ref() - btrfs: fix warning in scrub_verify_one_metadata() - btrfs: print correct subvol num if active swapfile prevents deletion - btrfs: fix compat mask in error messages in btrfs_check_features() - [arm64] bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing - bpf: Fix stack-out-of-bounds write in devmap - PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value - [amd64] x86/acpi/boot: Correct acpi_is_processor_usable() check again - [arm64] memory: mtk-smi: fix device leaks on common probe - [arm64] memory: mtk-smi: fix device leak on larb probe - resource: Add resource set range and size helpers - PCI: Use resource_set_range() that correctly sets ->end - media: tegra-video: Fix memory leak in __tegra_channel_try_format() - media: dw9714: move power sequences to dedicated functions - media: dw9714: add support for powerdown pin - media: dw9714: Fix powerup sequence - [amd64] KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() - ata: libata-scsi: Refactor ata_scsi_simulate() - ata: libata-scsi: Refactor ata_scsiop_read_cap() - ata: libata-scsi: Refactor ata_scsiop_maint_in() - ata: libata-scsi: Document all VPD page inquiry actors - ata: libata-scsi: Remove struct ata_scsi_args - ata: libata: Remove ATA_DFLAG_ZAC device flag - ata: libata: Introduce ata_port_eh_scheduled() - ata: libata-scsi: avoid Non-NCQ command starvation - [arm64,armhf] drm/tegra: dsi: fix device leak on probe - ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT - ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O - mailbox: don't protect of_parse_phandle_with_args with con_mutex - mailbox: sort headers alphabetically - mailbox: remove unused header files - mailbox: Use dev_err when there is error - mailbox: Use guard/scoped_guard for con_mutex - mailbox: Allow controller specific mapping using fwnode - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() - ext4: add ext4_try_lock_group() to skip busy groups - ext4: factor out __ext4_mb_scan_group() - ext4: factor out ext4_mb_might_prefetch() - ext4: factor out ext4_mb_scan_group() - ext4: convert free groups order lists to xarrays - ext4: refactor choose group to scan group - ext4: implement linear-like traversal across order xarrays - ext4: always allocate blocks only from groups inode can use - workqueue: Add system_percpu_wq and system_dfl_wq - Input: synaptics_i2c - replace use of system_wq with system_dfl_wq - Input: synaptics_i2c - guard polling restart in resume - [amd64] iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode - [arm64] dts: rockchip: Fix rk356x PCIe range mappings - [arm64] dts: rockchip: Fix rk3588 PCIe range mappings - [armhf] clk: tegra: tegra124-emc: fix device leak on set_rate() - ima: kexec: silence RCU list traversal warning - ima: rename variable the seq_file "file" to "ima_kexec_file" - ima: define and call ima_alloc_kexec_file_buf() - kexec: define functions to map and unmap segments - ima: kexec: define functions to copy IMA log at soft boot - ima: verify the previous kernel's IMA buffer lies in addressable RAM - of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range() - drm/exynos: vidi: fix to avoid directly dereferencing user pointer - drm/exynos/vidi: Remove redundant error handling in vidi_get_modes() - drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free (CVE-2026-23227) - uprobes: switch to RCU Tasks Trace flavor for better performance - uprobes: Fix incorrect lockdep condition in filter_chain() - btrfs: drop unused parameter fs_info from do_reclaim_sweep() - btrfs: get used bytes while holding lock at btrfs_reclaim_bgs_work() - btrfs: fix reclaimed bytes accounting after automatic block group reclaim - btrfs: fix periodic reclaim condition - btrfs: zoned: fix alloc_offset calculation for partly conventional block groups - btrfs: zoned: fixup last alloc pointer after extent removal for RAID1 - btrfs: zoned: fixup last alloc pointer after extent removal for DUP - btrfs: zoned: fix stripe width calculation - btrfs: define the AUTO_KFREE/AUTO_KVFREE helper macros - btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10 - [riscv64] usb: cdns3: remove redundant if branch - [riscv64] usb: cdns3: call cdns_power_is_lost() only once in cdns_resume() - [riscv64] usb: cdns3: fix role switching during resume - drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected() (Closes: #1130930) - ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 - hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race - ksmbd: check return value of xa_store() in krb5_authenticate - ksmbd: add chann_lock to protect ksmbd_chann_list xarray (CVE-2026-23226) - ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023) - ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG) - ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314 - net: arcnet: com20020-pci: fix support for 2.5Mbit cards - eventpoll: Fix integer overflow in ep_loop_check_proc() - namespace: fix proc mount iteration - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - nfc: pn533: properly drop the usb interface reference on disconnect - net: usb: kaweth: validate USB endpoints - net: usb: kalmia: validate USB endpoints - net: usb: pegasus: validate USB endpoints - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message - can: usb: f81604: correctly anchor the urb in the read bulk callback - can: ucan: Fix infinite loop from zero-length messages - can: usb: etas_es58x: correctly anchor the urb in the read bulk callback - can: usb: f81604: handle short interrupt urb messages properly - can: usb: f81604: handle bulk write errors properly - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them - [amd64] x86/efi: defer freeing of boot services memory - [amd64] platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data - [amd64] platform/x86: dell-wmi: Add audio/mic mute key codes - ALSA: usb-audio: Use correct version for UAC3 header validation - wifi: radiotap: reject radiotap with unknown bits - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() - wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() - IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() - net/sched: ets: fix divide by zero in the offload path - nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit(). - tracing: Fix WARN_ON in tracing_buffers_mmap_close - scsi: target: Fix recursive locking in __configfs_open_file() - Squashfs: check metadata block offset is within range - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() - drbd: fix null-pointer dereference on local read error - smb: client: fix cifs_pick_channel when channels are equally loaded - smb: client: fix broken multichannel with krb5+signing - smb: client: Don't log plaintext credentials in cifs_set_cifscreds - scsi: core: Fix refcount leak for tagset_refcnt - xattr: switch to CLASS(fd) (CVE-2024-14027) - btrfs: always fallback to buffered write if the inode requires checksum - ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with clang < 18 - nvme: fix admin queue leak on controller reset - hwmon: (aht10) Add support for dht20 - hwmon: (aht10) Fix initialization commands for AHT20 - pinctrl: equilibrium: rename irq_chip function callbacks - pinctrl: equilibrium: fix warning trace on load - [amd64] platform/x86: thinkpad_acpi: Fix errors reading battery thresholds - HID: multitouch: add quirks for Lenovo Yoga Book 9i - HID: multitouch: new class MT_CLS_EGALAX_P80H84 - [amd64] pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() - hwmon: (it87) Check the it87_lock() return value - [amd64,arm64] idpf: change IRQ naming to match netdev and ethtool queue numbering - i40e: Fix preempt count leak in napi poll tracepoint - e1000e: clear DPG_EN after reset to avoid autonomous power-gating - drm/solomon: Fix page start when updating rectangle in page addressing mode - net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table - xsk: Get rid of xdp_buff_xsk::xskb_list_node - xsk: s/free_list_node/list_node/ - xsk: Fix fragment node deletion to prevent buffer leak - xsk: Fix zero-copy AF_XDP fragment drop - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs - [arm64] net: ti: icssg-prueth: Fix ping failure after offload mode setup when link speed is not 1G - amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds - can: bcm: fix locking for bcm_op runtime updates - can: mcp251x: fix deadlock in error path of mcp251x_open - wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config - drm/xe: Do not preempt fence signaling CS instructions - kunit: tool: copy caller args in run_kernel to prevent mutation - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded - octeon_ep: Relocate counter updates before NAPI - octeon_ep: avoid compiler and IQ/OQ reordering - octeon_ep_vf: Relocate counter updates before NAPI - octeon_ep_vf: avoid compiler and IQ/OQ reordering - wifi: cw1200: Fix locking in error paths - wifi: wlcore: Fix a locking bug - wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() - wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() - indirect_call_wrapper: do not reevaluate function pointer - net/rds: Fix circular locking dependency in rds_tcp_tune - xen/acpi-processor: fix _CST detection using undersized evaluation buffer - iavf: fix netdev->max_mtu to respect actual hardware limit - bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim - smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op() - smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info() - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() - net: ipv4: fix ARM64 alignment fault in multipath hash seed - amd-xgbe: fix sleep while atomic on suspend/resume - drm/sched: Fix kernel-doc warning for drm_sched_job_done() - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" - drm/xe/reg_sr: Fix leak on xa_store failure - nvme: reject invalid pr_read_keys() num_keys values - nvme: fix memory allocation in nvme_pr_read_keys() - hwmon: (max6639) : Configure based on DT property - hwmon: (max6639) fix inverted polarity - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - net: nfc: nci: Fix zero-length proprietary notifications - net_sched: sch_fq: clear q->band_pkt_count[] in fq_reset() - nfc: nci: free skb on nci_transceive early error paths - nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback - nfc: rawsock: cancel tx_work before socket teardown - net: stmmac: Fix error handling in VLAN add and delete paths - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase - net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop - net/sched: act_ife: Fix metalist update behavior - xdp: use modulo operation to calculate XDP frag tailroom - xsk: introduce helper to determine rxq->frag_size - i40e: fix registering XDP RxQ info - i40e: use xdp.frame_sz as XDP RxQ info frag_size - xdp: produce a warning when calculated tailroom is negative - tracing: Add NULL pointer check to trigger_data_free() - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks - ext4: fix potential null deref in ext4_mb_init() - ata: libata-core: fix cancellation of a port deferred qc work - ata: libata-eh: correctly handle deferred qc timeouts - ata: libata: cancel pending work after clearing deferred_qc - ata: libata-eh: Fix detection of deferred qc timeouts https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.78 - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - [amd64] ACPI: PM: Save NVS memory on Lenovo G70-35 - scsi: mpi3mr: Add NULL checks when resetting request and reply queues - ALSA: hda/realtek: Fix speaker pop on Star Labs StarFighter - unshare: fix unshare_fs() handling - wifi: mac80211: set default WMM parameters on all links - ACPI: OSI: Add DMI quirk for Acer Aspire One D255 - scsi: ses: Fix devices attaching to different hosts - [amd64] ASoC: amd: yc: Add ASUS EXPERTBOOK BM1503CDA to quirk table - [amd64] ASoC: cs42l43: Report insert for exotic peripherals - scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() - scsi: ufs: core: Fix shift out of bounds when MAXQ=32 - ALSA: usb-audio: Avoid implicit feedback mode on DIYINHK USB Audio 2.0 - drm/amdgpu/vcn5: Add SMU dpm interface type - ALSA: usb-audio: Check max frame size for implicit feedback mode, too - kexec: Consolidate machine_kexec_mask_interrupts() implementation - kexec: Include kernel-end even without crashkernel - [powerpc*] kexec/core: use big-endian types for crash variables - [powerpc*] crash: adjust the elfcorehdr size - remoteproc: sysmon: Correct subsys_name_len type in QMI request - remoteproc: mediatek: Unprepare SCP clock during system suspend - [powerpc*] 83xx: km83xx: Fix keymile vendor prefix - smb/server: Fix another refcount leak in smb2_open() - nfs: return EISDIR on nfs3_proc_create if d_alias is a dir - [arm64] drm/msm/dsi: fix hdisplay calculation when programming dsi registers - xprtrdma: Decrement re_receiving on the early exit paths - btrfs: hold space_info->lock when clearing periodic reclaim ready - workqueue: Use POOL_BH instead of WQ_BH when checking pool flags - perf disasm: Fix off-by-one bug in outside check - [arm64] drm/msm/dsi: fix pclk rate calculation for bonded dsi - drm/amd/pm: add missing od setting PP_OD_FEATURE_ZERO_FAN_BIT for smu v14 - bonding: handle BOND_LINK_FAIL, BOND_LINK_BACK as valid link states - net/mlx5: IFC updates for disabled host PF - net/mlx5: Query to see if host PF is disabled - net/mlx5: Fix deadlock between devlink lock and esw->wq - net/mlx5: Fix crash when moving to switchdev mode - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery - net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (CVE-2026-23277) - ASoC: soc-core: drop delayed_work_pending() check before flush - ASoC: soc-core: flush delayed work before removing DAIs and widgets - ASoC: simple-card-utils: use __free(device_node) for device node - ASoC: simple-card-utils: fix graph_util_is_ports0() for DT overlays - net: sfp: improve Huawei MA5671a fixup - serial: caif: hold tty->link reference in ldisc_open and ser_release - bnxt_en: Fix RSS table size check when changing ethtool channels - mctp: i2c: fix skb memory leak in receive path - can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value - bonding: add ESP offload features when slaves support - bonding: Correctly support GSO ESP offload - net: add a common function to compute features for upper devices - bonding: use common function to compute the features - bonding: fix type confusion in bond_setup_by_slave() - mctp: route: hold key->lock in mctp_flow_prepare_output() - [amd64,arm64] amd-xgbe: fix link status handling in xgbe_rx_adaptation - [amd64,arm64] amd-xgbe: prevent CRC errors during RX adaptation with AN disabled - xdp: allow attaching already registered memory model to xdp_rxq_info - xdp: register system page pool as an XDP memory model - net: add xmit recursion limit to tunnel xmit functions (CVE-2026-23276) - netfilter: nf_tables: always walk all pending catchall elements (CVE-2026-23278) - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() - netfilter: x_tables: guard option walkers against 1-byte tail reads - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (CVE-2026-23274) - perf annotate: Fix hashmap__new() error checking - regulator: pca9450: Correct interrupt type - perf ftrace: Fix hashmap__new() error checking - sched: idle: Make skipping governor callbacks more consistent - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set - nvme-pci: Fix race bug in nvme_poll_irqdisable() - i40e: fix src IP mask checks and memcpy argument names in cloud filter - e1000/e1000e: Fix leak in DMA error cleanup - net: bcmgenet: fix broken EEE by converting to phylib-managed state - ACPI: OSL: fix __iomem type on return from acpi_os_map_generic_address() - [amd64] ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition - ASoC: detect empty DMI strings - drm/amdkfd: Unreserve bo if queue update failed - net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled - [arm64] octeontx2-af: devlink: fix NIX RAS reporter recovery condition - [arm64] octeontx2-af: devlink: fix NIX RAS reporter to use RAS interrupt status - net: prevent NULL deref in ip[6]tunnel_xmit() - iio: imu: inv-mpu9150: fix irq ack preventing irq storms - usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - Revert "arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on" - cgroup: fix race between task migration and iteration - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces - net: usb: lan78xx: fix silent drop of packets with checksum errors - net: usb: lan78xx: fix TX byte statistics for small packets - net: usb: lan78xx: skip LTM configuration for LAN7850 - ata: libata-core: Add BRIDGE_OK quirk for QEMU drives - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK PM1503CDA - [amd64] KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC - USB: add QUIRK_NO_BOS for video capture several devices - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed - usb: xhci: Fix memory leak in xhci_disable_slot() - usb: xhci: Prevent interrupt storm on host controller error (HCE) - usb: yurex: fix race in probe - usb: dwc3: pci: add support for the Intel Nova Lake -H - usb: misc: uss720: properly clean up reference in uss720_probe() - usb: core: don't power off roothub PHYs if phy_set_mode() fails - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 - usb: roles: get usb role switch from parent only for usb-b-connector - usb: typec: altmode/displayport: set displayport signaling rate in configure message - USB: usbcore: Introduce usb_bulk_msg_killable() - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts - USB: core: Limit the length of unkillable synchronous timeouts - usb: class: cdc-wdm: fix reordering issue in read code path - usb: mdc800: handle signal and read racing - usb: image: mdc800: kill download URB on timeout - mm/tracing: rss_stat: ensure curr is false from kthread context - mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() - mm/kfence: disable KFENCE upon KASAN HW tags enablement - mmc: core: Avoid bitfield RMW for claim/retune flags - [arm64] ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start - tipc: fix divide-by-zero in tipc_sk_filter_connect() - kprobes: avoid crash when rmmod/insmod after ftrace killed - ceph: add a bunch of missing ceph_path_info initializers - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() - libceph: reject preamble if control segment is empty - libceph: prevent potential out-of-bounds reads in process_message_header() - libceph: Use u32 for non-negative values in ceph_monmap_decode() - libceph: admit message frames only in CEPH_CON_S_OPEN state - ceph: fix i_nlink underrun during async unlink - ceph: fix memory leaks in ceph_mdsc_build_path() - time/jiffies: Mark jiffies_64_to_clock_t() notrace - i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach - scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend - scsi: hisi_sas: Add time interval between two H2D FIS following soft reset spec - scsi: hisi_sas: Use macro instead of magic number - scsi: hisi_sas: Fix NULL pointer exception during user_scan() - kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17 - Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures - Revert "tcpm: allow looking for role_sw device in the main node" - drm/amd: Disable MES LR compute W/A - drm/bridge: samsung-dsim: Fix memory leak in error path - drm/bridge: ti-sn65dsi86: Enable HPD polling if IRQ is not used - [s390x] pfault: Fix virtual vs physical address confusion - nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit(). - device property: Allow secondary lookup in fwnode_get_next_child_node() - [arm64,armhf] irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports - btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() - ice: reintroduce retry mechanism for indirect AQ - ixgbevf: fix link setup issue - staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie - media: dvb-net: fix OOB access in ULE extension header tables - [amd64,arm64] net: mana: Ring doorbell at 4 CQ wraparounds - ice: fix retry for AQ command 0x06EE - tracing: Fix syscall events activation by ensuring refcount hits zero - net/tcp-ao: Fix MAC comparison to be constant-time - batman-adv: Avoid double-rtnl_lock ELP metric worker - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep - [arm64] mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation - hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read - [arm64] contpte: fix set_access_flags() no-op check for SMMU/ATS faults - pmdomain: bcm: bcm2835-power: Fix broken reset status read - ata: libata-core: Disable LPM on ST1000DM010-2EP102 - drm/amd/display: Fallback to boot snapshot for dispclk - ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() - smb: server: fix use-after-free in smb2_open() - ksmbd: fix use-after-free by using call_rcu() for oplock_info - net: nexthop: fix percpu use-after-free in remove_nh_grp_entry - net: ncsi: fix skb leak in error paths - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ - net: dsa: microchip: Fix error path in PTP IRQ setup - drm/amd/pm: remove invalid gpu_metrics.energy_accumulator on smu v13.0.x - drm/amdgpu: Fix use-after-free race in VM acquire - drm/amd: Set num IP blocks to 0 if discovery fails - drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding - [amd64] drm/i915: Fix potential overflow of shmem scatterlist length - [arm64] drm/msm: Fix dma_free_attrs() buffer size - tracing: Fix enabling multiple events on the kernel command line and bootconfig - tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size - cifs: make default value of retrans as zero - xfs: fix returned valued from xfs_defer_can_append - xfs: fix undersized l_iclog_roundoff values - xfs: ensure dquot item is deleted from AIL only after log shutdown - [s390x] dasd: Move quiesce state with pprc swap - [s390x] dasd: Copy detected format information to secondary device - lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error - scsi: core: Fix error handling for scsi_alloc_sdev() - [amd64] x86/apic: Disable x2apic on resume if the kernel expects so - lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after() - lib/bootconfig: check bounds before writing in __xbc_open_brace() - smb: client: fix atomic open with O_DIRECT & O_SYNC - smb: client: fix in-place encryption corruption in SMB2_write() - smb: client: fix iface port assignment in parse_server_interfaces - btrfs: fix transaction abort on file creation due to name hash collision - btrfs: fix transaction abort on set received ioctl due to item overflow - btrfs: abort transaction on failure to update root in the received subvol ioctl - iio: dac: ds4424: reject -128 RAW value - iio: frequency: adf4377: Fix duplicated soft reset mask - iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas() - iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() - iio: potentiometer: mcp4131: fix double application of wiper shift - iio: chemical: bme680: Fix measurement wait duration calculation - iio: buffer: Fix wait_queue not being removed - iio: gyro: mpu3050-core: fix pm_runtime error handling - iio: gyro: mpu3050-i2c: fix pm_runtime error handling - iio: imu: inv_icm42600: fix odr switch to the same value - iio: imu: inv_icm42600: fix odr switch when turning buffer off - iio: proximity: hx9023s: Protect against division by zero in set_samp_freq - i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors - i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort - i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor - drm/bridge: ti-sn65dsi86: Add support for DisplayPort mode with HPD - net/tcp-md5: Fix MAC comparison to be constant-time - ksmbd: Compare MACs in constant time (CVE-2026-23364) - smb: client: Compare MACs in constant time - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() - ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths - spi: cadence-quadspi: Implement refcount to handle unbind during busy (CVE-2025-40005) - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (CVE-2026-23386) - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (CVE-2026-23368) - [amd64] x86/sev: Allow IBPB-on-Entry feature for SNP guests - [amd64] platform/x86: hp-bioscfg: Support allocations of larger data (Closes: #1127612) - wifi: libertas: fix use-after-free in lbs_free_adapter() (CVE-2026-23281) - [amd64] perf/x86/intel/uncore: Support more units on Granite Rapids - [amd64] perf/x86/intel/uncore: Add per-scheduler IMC CAS count events - mptcp: pm: in-kernel: always mark signal+subflow endp as used - mptcp: pm: avoid sending RM_ADDR over same subflow - drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink - kbuild: Leave objtool binary around with 'make clean' - net/sched: act_gate: snapshot parameters with RCU on replace (CVE-2026-23245) - xfs: Fix error pointer dereference - can: gs_usb: gs_can_open(): always configure bitrates before starting device - cleanup: Provide retain_and_null_ptr() - usb: gadget: f_ncm: Fix net_device lifecycle with device_move - usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling - [amd64] KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids - [amd64] KVM: SVM: Add a helper to look up the max physical ID for AVIC - [amd64] KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated - [arm64,armhf] mmc: dw_mmc-rockchip: use modern PM macros - [arm64,armhf] mmc: dw_mmc-rockchip: Add memory clock auto-gating support - [arm64,armhf] mmc: dw_mmc-rockchip: Fix runtime PM support for internal phase support - mm/page_alloc: move set_page_refcounted() to callers of post_alloc_hook() - mm/page_alloc: sort out the alloc_contig_range() gfp flags mess - mm/page_alloc: forward the gfp flags from alloc_contig_range() to post_alloc_hook() - mm/kfence: fix KASAN hardware tag faults during late enablement - nsfs: tighten permission checks for ns iteration ioctls - sched_ext: Disable preemption between scx_claim_exit() and kicking helper work - sched_ext: Fix starvation of scx_enable() under fair-class saturation - iomap: reject delalloc mappings during writeback - fgraph: Fix thresh_return clear per-task notrace - [amd64] KVM: x86: Co-locate initialization of feature MSRs in kvm_arch_vcpu_create() - [amd64] KVM: x86: Quirk initialization of feature MSRs to KVM's max configuration - [amd64] KVM: x86: do not allow re-enabling quirks - [amd64] KVM: x86: Allow vendor code to disable quirks - [amd64] KVM: x86: Introduce supported_quirks to block disabling quirks - [amd64] KVM: x86: Introduce Intel specific quirk KVM_X86_QUIRK_IGNORE_GUEST_PAT - [amd64] KVM: nVMX: Add consistency checks for CR0.WP and CR4.CET - [amd64] KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM - ksmbd: Don't log keys in SMB3 signing and encryption key generation - drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output - net: macb: Shuffle the tx ring before enabling tx - cifs: open files should not hold ref on superblock - xfs: fix integer overflow in bmap intent sort comparator - drm/xe/sync: Cleanup partially initialized sync on parse failure - ipv6: use RCU in ip6_xmit() (CVE-2025-40135) - dm-verity: disable recursive forward error correction (CVE-2025-71161) - rxrpc: Fix recvmsg() unconditional requeue - btrfs: do not strictly require dirty metadata threshold for metadata writepages (CVE-2026-23157) - ice: fix devlink reload call trace (CVE-2026-23104) - tracing: Add recursion protection in kernel stack trace recording (CVE-2026-23138) - [amd64] Octeontx2-af: Add proper checks for fwdata (CVE-2026-23070) - io_uring/uring_cmd: fix too strict requirement on ioctl - [amd64] x86/uprobes: Fix XOL allocation failure for 32-bit tasks - [amd64] platform/x86/amd/pmc: Add support for Van Gogh SoC (CVE-2025-68334) - mptcp: pm: in-kernel: always set ID as avail when rm endp - net: stmmac: remove support for lpi_intr_o - f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi - f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic (CVE-2025-38627) - f2fs: fix to avoid migrating empty section (CVE-2025-40150) - blk-throttle: fix access race during throttle policy activation (CVE-2025-40147) - dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() (CVE-2025-71221) - net: dsa: properly keep track of conduit reference (CVE-2025-71152) - binfmt_misc: restore write access before closing files opened by open_exec() (CVE-2025-68239) - xfs: get rid of the xchk_xfile_*_descr calls - erofs: fix inline data read failure for ztailpacking pclusters - mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375) - sched_ext: Remove redundant css_put() in scx_cgroup_init() - io_uring/kbuf: check if target buffer list is still legacy on recycle - sched/fair: Fix zero_vruntime tracking - [s390x] stackleak: Fix __stackleak_poison() inline assembly constraint - [s390x] xor: Fix xor_xc_2() inline assembly constraints - [amd64] drm/i915/alpm: ALPM disable fixes - [amd64] drm/i915/psr: Repeat Selective Update area alignment - drm/amd/display: Add pixel_clock to amd_pp_display_configuration - drm/amd/pm: Use pm_display_cfg in legacy DPM (v2) - drm/amdgpu: Add basic validation for RAS header (CVE-2025-38426) - NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache - HID: bpf: prevent buffer overflow in hid_hw_request - sunrpc: fix cache_request leak in cache_release - nvdimm/bus: Fix potential use after free in asynchronous initialization - NFC: nxp-nci: allow GPIOs to sleep - net: macb: fix use-after-free access to PTP clock - mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access - smb: client: fix krb5 mount with username option - ksmbd: unset conn->binding on failed binding request - ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION - [amd64] drm/i915/dsc: Add Selective Update register definitions - [amd64] drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters - [amd64] drm/i915/psr: Write DSC parameters on Selective Update in ET mode - [s390x] zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute - kprobes: Remove unneeded goto - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace() - btrfs: fix transaction abort when snapshotting received subvolumes - batman-adv: avoid OGM aggregation when skb tailroom is insufficient - net: macb: Introduce gem_init_rx_ring() - net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume - ata: libata-core: disable LPM on ADATA SU680 SSD - mmc: sdhci-pci-gli: fix GL9750 DMA write corruption - mmc: sdhci: fix timing selection for 1-bit bus width - pmdomain: bcm: bcm2835-power: Increase ASB control timeout - spi: fix use-after-free on controller registration failure - spi: fix statistics allocation - mtd: rawnand: pl353: make sure optimal timings are applied - mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init() - mtd: Avoid boot crash in RedBoot partition table parser - [amd64] iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry - serial: 8250_pci: add support for the AX99100 - serial: 8250: Fix TX deadlock when using DMA - serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY - serial: uartlite: fix PM runtime usage count underflow on probe - io_uring/kbuf: propagate BUF_MORE through early buffer commit path - drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug - drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END} - drm/amdgpu/gmc9.0: add bounds checking for cid - drm/amdgpu/mmhub2.0: add bounds checking for cid - drm/amdgpu/mmhub2.3: add bounds checking for cid - drm/amdgpu/mmhub3.0.1: add bounds checking for cid - drm/amdgpu/mmhub3.0.2: add bounds checking for cid - drm/amdgpu/mmhub3.0: add bounds checking for cid - drm/amdgpu/mmhub4.1.0: add bounds checking for cid - drm/imagination: Fix deadlock in soft reset sequence - drm/radeon: apply state adjust rules to some additional HAINAN vairants - drm/amdgpu: apply state adjust rules to some additional HAINAN vairants - drm/xe/oa: Allow reading after disabling OA stream - drm/xe: Open-code GGTT MMIO access protection - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (CVE-2026-23395) - ata: libata-scsi: Return residual for emulated SCSI commands - ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in() - btrfs: log new dentries when logging parent dir of a conflicting inode - btrfs: tree-checker: fix misleading root drop_level error message - [riscv64] soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe() - [riscv64] cache: starfive: fix device node leak in starlink_cache_init() - [arm64,armhf] soc: rockchip: grf: Add missing of_node_put() when returning - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down - [arm64] dts: renesas: r9a09g057: Add RTC node - [arm64] dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes - [arm64] firmware: arm_scpi: Fix device_node reference leak in probe path - Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU - Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU - Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy - Bluetooth: ISO: Fix defer tests being unstable - Bluetooth: hci_sync: Fix hci_le_create_conn_sync - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers - Bluetooth: HIDP: Fix possible UAF - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user - Bluetooth: qca: fix ROM version reading on WCN3998 chips - bridge: cfm: Fix race condition in peer_mep deletion (CVE-2026-23393) - net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect - mpls: add missing unregister_netdevice_notifier to mpls_init - netfilter: ctnetlink: remove refcounting in expectation dumpers (CVE-2025-39764) - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (CVE-2026-23399) - netfilter: nft_ct: drop pending enqueued packets on removal - netfilter: xt_CT: drop pending enqueued packets on template removal (CVE-2026-23391) - netfilter: xt_time: use unsigned int for monthday bit shift - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() - net: bcmgenet: increase WoL poll timeout - [amd64,arm64] net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown - sched: idle: Consolidate the handling of two special cases - PM: runtime: Fix a race condition related to device removal - bonding: prevent potential infinite loop in bond_header_parse() - net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() - net/sched: teql: Fix double-free in teql_master_xmit - net: airoha: read default PSE reserved pages value before updating - net: airoha: fix PSE memory configuration in airoha_fe_pse_ports_init() - net: airoha: Read completion queue data in airoha_qdma_tx_napi_poll() - net: airoha: Remove airoha_dev_stop() in airoha_remove() - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check - clsact: Fix use-after-free in init/destroy rollback asymmetry - net: usb: aqc111: Do not perform PM inside suspend callback - igc: fix missing update of skb->tail in igc_xmit_frame() - igc: fix page fault in XDP TX timestamps handling - iavf: fix VLAN filter lost on add/delete race - wifi: mac80211: fix NULL deref in mesh_matches_local() (CVE-2026-23396) - wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom - ACPI: processor: Fix previous acpi_processor_errata_piix4() fix - net: macb: fix uninitialized rx_fs_lock - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - net/mlx5e: Prevent concurrent access to IPSec ASO context - net/mlx5e: Fix race condition during IPSec ESN update - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n - net: bonding: fix NULL deref in bond_debug_rlb_hash_show - netfilter: bpf: defer hook memory release until rcu readers are done - netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392) - nfnetlink_osf: validate individual option lengths in fingerprints (CVE-2026-23397) - [arm64,armhf] net: mvpp2: guard flow control update with global_tx_fc in buffer switching - [armhf] net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths - icmp: fix NULL pointer dereference in icmp_tag_validation() (CVE-2026-23398) - hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value - hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit() - [amd64] drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state - USB: serial: f81232: fix incomplete serial port generation - i2c: cp2615: fix serial string NULL-deref at probe - i2c: fsi: Fix a potential leak in fsi_i2c_probe() - i2c: pxa: defer reset on Armada 3700 when recovery is used - ring-buffer: Fix to update per-subbuf entries of persistent ring buffer - [amd64] x86/platform/uv: Handle deconfigured sockets - mtd: spi-nor: core: avoid odd length/address reads on 8D-8D-8D mode - mtd: spi-nor: core: avoid odd length/address writes in 8D-8D-8D mode - mm: shmem: fix potential data corruption during shmem swapin - mm: shmem: avoid unpaired folio_unlock() in shmem_swapin_folio() - mm/shmem, swap: improve cached mTHP handling and fix potential hang - mm/shmem, swap: avoid redundant Xarray lookup during swapin - mtd: rawnand: serialize lock/unlock against other NAND operations - mtd: rawnand: brcmnand: skip DMA during panic write - drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr() - drm/amd: fix dcn 2.01 check - ksmbd: fix use-after-free of share_conf in compound request - ksmbd: fix use-after-free in durable v2 replay of active file handles - [amd64] drm/i915/gt: Check set_default_submission() before deferencing - lib/bootconfig: check xbc_init_node() return in override path - tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure - hwmon: (max6639) Fix pulses-per-revolution implementation - [amd64] perf/x86/intel: Add missing branch counters constraint apply - xen/privcmd: restrict usage in unprivileged domU (CVE-2026-31788) - xen/privcmd: add boot control for restricted usage in domU https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.79 https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.80 - cxl/port: Fix use after free of parent_port in cxl_detach_ep() - bpf: Fix constant blinding for PROBE_MEM32 stores (CVE-2026-23417) (Closes: #1132622) - perf: Make sure to use pmu_ctx->pmu for groups - cxl/hdm: Avoid incorrect DVSEC fallback when HDM decoders are enabled - hwmon: axi-fan: don't use driver_override as IRQ name - driver core: generalize driver_override in struct device - driver core: platform: use generic driver_override infrastructure - bpf: Release module BTF IDR before module unload - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN - bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR - HID: asus: avoid memory leak in asus_report_fixup() - [amd64] platform/x86: intel-hid: Add Dell 14 Plus 2-in-1 to dmi_vgbs_allow_list - nvme-pci: cap queue creation to used queues - nvme-fabrics: use kfree_sensitive() for DHCHAP secrets - [amd64] platform/x86: intel-hid: Enable 5-button array on ThinkPad X1 Fold 16 Gen 1 - [amd64] platform/x86: touchscreen_dmi: Add quirk for y-inverted Goodix touchscreen on SUPI S10 - nvme-pci: ensure we're polling a polled queue - HID: magicmouse: fix battery reporting for Apple Magic Trackpad 2 - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() - HID: apple: Add EPOMAKER TH87 to the non-apple keyboards list - net: usb: r8152: add TRENDnet TUC-ET2G - kbuild: install-extmod-build: Package resolve_btfids if necessary - HID: mcp2221: cancel last I2C command on read error - HID: asus: add xg mobile 2023 external hardware support - module: Fix kernel panic when a symbol st_shndx is out of bounds - scsi: mpi3mr: Clear reset history on ready and recheck state after timeout - scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP - dma-buf: Include ioctl.h in UAPI header - ALSA: hda/senary: Ensure EAPD is enabled during init - HID: apple: avoid memory leak in apple_report_fixup() - sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update - btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create - ALSA: hda/realtek: add HP Laptop 14s-dr5xxx mute LED quirk - ALSA: hda/realtek: Add headset jack quirk for Thinkpad X390 - objtool: Handle Clang RSP musical chairs - nvmet: move async event work off nvmet-wq - drm/amdgpu: fix gpu idle power consumption issue for gfx v12 - usb: core: new quirk to handle devices with zero configurations - spi: intel-pci: Add support for Nova Lake mobile SPI flash - ALSA: hda/realtek: add quirk for ASUS UM6702RC - i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter - xfrm: add missing extack for XFRMA_SA_PCPU in add_acquire and allocspi - xfrm: fix the condition on x->pcpu_num in xfrm_sa_len - xfrm: call xdo_dev_state_delete during state update - xfrm: Fix the usage of skb->sk - esp: fix skb leak with espintcp and async crypto - xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() - xfrm: prevent policy_hthresh.work from racing with netns teardown - af_key: validate families in pfkey_send_migrate() - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() - erofs: set fileio bio failed in short read case - can: statistics: add missing atomic access in hot path - Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete - Bluetooth: hci_ll: Fix firmware leak on error path - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb - [arm64] pinctrl: mediatek: common: Fix probe failure for devices without EINT - ionic: fix persistent MAC address override on PF - nfc: nci: fix circular locking dependency in nci_close_device - net: openvswitch: Avoid releasing netdev before teardown completes - openvswitch: defer tunnel netdev_put to RCU release - openvswitch: validate MPLS set/set_masked payload length - net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer - rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size - net: bcm: asp2: fix LPI timer handling - net: bcm: asp2: remove tx_lpi_enabled - net: bcm: asp2: convert to phylib managed EEE - net: bcmasp: Remove support for asp-v2.0 - net: bcmasp: streamline early exit in probe - net: bcmasp: fix double free of WoL irq - net: bcmasp: Add support for asp-v3.0 - net: bcmasp: fix double disable of clk - [armhf] platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen - [amd64] platform/x86: intel-hid: disable wakeup_mode during hibernation - ice: fix inverted ready check for VF representors - ice: use ice_update_eth_stats() for representor stats - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() - ipv6: Remove permanent routes from tb6_gc_hlist when all exceptions expire. - ipv6: Don't remove permanent routes with exceptions from tb6_gc_hlist. - net: fix fanout UAF in packet_release() via NETDEV_UP race - tcp: optimize inet_use_bhash2_on_bind() - udp: Fix wildcard bind conflict check when using hash2 - net: enetc: fix the output issue of 'ethtool --show-ring' - team: fix header_ops type confusion with non-Ethernet ports - net: lan743x: fix duplex configuration in mac_link_up - dma-mapping: add missing `inline` for `dma_free_attrs` - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop - Bluetooth: btusb: clamp SCO altsetting table indices - tls: Purge async_hold in tls_decrypt_async_wait() (CVE-2026-23414) - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() - netfilter: nf_conntrack_expect: skip expectations in other netns via proc - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp - netfilter: ctnetlink: use netlink policy range checks - net: macb: use the current queue number for stats - regmap: Synchronize cache for the page selector - ALSA: hda/realtek: Sequence GPIO2 on Star Labs StarFighter - RDMA/rw: Fall back to direct SGE on MR pool exhaustion - RDMA/irdma: Initialize free_qp completion before using it - RDMA/irdma: Update ibqp state to error if QP is already in error state - RDMA/irdma: Remove a NOP wait_event() in irdma_modify_qp_roce() - RDMA/irdma: Clean up unnecessary dereference of event->cm_node - RDMA/irdma: Remove reset check from irdma_modify_qp_to_err() - RDMA/irdma: Fix deadlock during netdev reset with active connections - RDMA/irdma: Return EINVAL for invalid arp index error - scsi: scsi_transport_sas: Fix the maximum channel scanning issue - [amd64] x86/efi: efi_unmap_boot_services: fix calculation of ranges_to_free size - [amd64] drm/i915/gmbus: fix spurious timeout on 512-byte burst reads - PM: hibernate: Drain trailing zero pages on userspace restore - spi: sn-f-ospi: Fix resource leak in f_ospi_probe() - [amd64] ASoC: Intel: catpt: Fix the device initialization - [arm64,armhf] spi: meson-spicc: Fix double-put in remove path - drm/amd/display: Do not skip unrelated mode changes in DSC validation - spi: Group CS related fields in struct spi_device - spi: use generic driver_override infrastructure - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib - hwmon: (adm1177) fix sysfs ABI violation and current unit conversion - hwmon: (pmbus/core) Fix various coding style issues - hwmon: (pmbus) Mark lowest/average/highest/rated attributes as read-only - hwmon: (pmbus) Introduce the concept of "write-only" attributes - sysctl: fix uninitialized variable in proc_do_large_bitmap - [s390x] syscalls: Add spectre boundary for syscall dispatch table - [s390x] barrier: Make array_index_mask_nospec() __always_inline - [s390x] entry: Scrub r12 register on kernel entry - ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() - ksmbd: fix potencial OOB in get_file_all_info() for compound requests - ksmbd: fix memory leaks and NULL deref in smb2_lock() - ksmbd: do not expire session on binding failure - ALSA: firewire-lib: fix uninitialized local variable - [amd64] ASoC: SOF: ipc4-topology: Allow bytes controls without initial payload - can: gw: fix OOB heap access in cgw_csum_crc8_rel() - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - cpufreq: conservative: Reset requested_freq on limits change - [amd64] platform/x86: ISST: Correct locked bit width - [arm64] KVM: arm64: Discard PC update state on vcpu reset - hwmon: (pmbus/isl68137) Add mutex protection for AVS enable sysfs attributes - hwmon: (peci/cputemp) Fix crit_hyst returning delta instead of absolute temperature - hwmon: (peci/cputemp) Fix off-by-one in cputemp_is_visible() - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false - erofs: add GFP_NOIO in the bio completion if needed - alarmtimer: Fix argument order in alarm_timer_forward() - [amd64] x86/cpu: Enable FSGSBASE early in cpu_init_exception_handling() - [amd64] x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask - [arm64] phy: qcom: qmp-ufs: Fix SM8650 PCS table for Gear 4 - ovl: fix wrong detection of 32bit inode numbers - scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() - scsi: ses: Handle positive SCSI error from ses_recv_diag() - net: macb: Move devm_{free,request}_irq() out of spin lock area - net: macb: Protect access to net_device::ip_ptr with RCU lock - net: macb: Use dev_consume_skb_any() to free TX SKBs - [amd64] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (CVE-2026-23401) - jbd2: gracefully abort on checkpointing state corruptions - [arm64] irqchip/qcom-mpm: Add missing mailbox TX done acknowledgment - futex: Clear stale exiting pointer in futex_lock_pi() retry path - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests - dmaengine: sh: rz-dmac: Protect the driver specific lists - dmaengine: sh: rz-dmac: Move CHCTRL updates under spinlock - drm/amdgpu: prevent immediate PASID reuse case - [amd64] drm/i915/dp_tunnel: Fix error handling when clearing stream BW in atomic state - xfs: stop reclaim before pushing AIL during unmount - xfs: save ailp before dropping the AIL lock in push callbacks - xfs: scrub: unlock dquot before early return in quota scrub - xfs: fix ri_total validation in xlog_recover_attri_commit_pass2 - xfs: don't irele after failing to iget in xfs_attri_recover_work - xfs: remove file_path tracepoint data - ext4: fix journal credit check when setting fscrypt context - ext4: convert inline data to extents when truncate exceeds inline size - ext4: fix stale xarray tags after writeback - ext4: fix fsync(2) for nojournal mode - ext4: make recently_deleted() properly work with lazy itable initialization - ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio - ext4: validate p_idx bounds in ext4_ext_correct_indexes - ext4: avoid infinite loops caused by residual data - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() - ext4: reject mount if bigalloc with s_first_data_block != 0 - ext4: fix use-after-free in update_super_work when racing with umount - ext4: fix the might_sleep() warnings in kvfree() - ext4: handle wraparound when searching for blocks for indirect mapped blocks - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths - ext4: always drain queued discard work in ext4_mb_release() - [arm64] dts: imx8mn-tqma8mqnl: fix LDO5 power off - [powerpc*] powerpc64/bpf: do not increment tailcall count when prog is NULL - ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() - tracing: Switch trace_osnoise.c code over to use guard() and __free() - tracing: Fix potential deadlock in cpu hotplug with osnoise - drm/xe: always keep track of remap prev/next - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] - ovl: Use str_on_off() helper in ovl_show_options() - ovl: make fsync after metadata copy-up opt-in mount option - xfs: avoid dereferencing log items after push callbacks - virt: tdx-guest: Fix handling of host controlled 'quote' buffer length - net: add proper RCU protection to /proc/net/ptype (CVE-2026-23255) - landlock: Optimize file path walks and prepare for audit support - landlock: Fix handling of disconnected directories (CVE-2025-68736) - ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (CVE-2025-22117) - ice: Fix PTP NULL pointer dereference during VSI rebuild (CVE-2026-23210) - [amd64,arm64] idpf: check error for register_netdev() on init - [amd64,arm64] idpf: detach and close netdevs while handling a reset (CVE-2026-22981) - [amd64,arm64] idpf: Fix RSS LUT NULL pointer crash on early ethtool operations (CVE-2026-22985) - [amd64,arm64] idpf: Fix RSS LUT NULL ptr issue after soft reset (CVE-2026-22993) - [amd64] dmaengine: idxd: Fix not releasing workqueue on .release() - [amd64] dmaengine: idxd: Fix memory leak when a wq is reset - [amd64] dmaengine: idxd: Fix freeing the allocated ida too late - phy: ti: j721e-wiz: Fix device node reference leak in wiz_get_lane_phy_types() - dmaengine: dw-edma: Fix multiple times setting of the CYCLE_STATE and CYCLE_BIT bits for HDMA. - netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators - [amd64] dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() - btrfs: fix super block offset in error message in btrfs_validate_super() - btrfs: fix leak of kobject name for sub-group space_info - btrfs: fix lost error when running device stats on multiple devices fs - xen/privcmd: unregister xenstore notifier on module exit - futex: Require sys_futex_requeue() to have identical flags - [amd64] dmaengine: idxd: Fix leaking event log memory - net: bcmasp: Restore programming of TX map vector register - net: bcmasp: Fix network filter wake for asp-3.0 - [amd64,arm64] idpf: nullify pointers after they are freed https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.81 - io_uring/kbuf: remove legacy kbuf bulk allocation - io_uring/kbuf: remove legacy kbuf kmem cache - io_uring/kbuf: simplify __io_put_kbuf - io_uring/kbuf: remove legacy kbuf caching - io_uring/kbuf: open code __io_put_kbuf() - io_uring/kbuf: introduce io_kbuf_drop_legacy() - io_uring/kbuf: uninline __io_put_kbufs - io_uring/kbuf: drop 'issue_flags' from io_put_kbuf(s)() arguments - io_uring/net: don't use io_net_kbuf_recyle() for non-provided cases - io_uring/net: clarify io_recv_buf_select() return value - io_uring/kbuf: pass in struct io_buffer_list to commit/recycle helpers - io_uring/kbuf: introduce struct io_br_sel - io_uring/kbuf: use struct io_br_sel for multiple buffers picking - io_uring/net: use struct io_br_sel->val as the recv finish value - io_uring/net: use struct io_br_sel->val as the send finish value - io_uring/kbuf: switch to storing struct io_buffer_list locally - io_uring: remove async/poll related provided buffer recycles - io_uring/net: correct type for min_not_zero() cast - io_uring/rw: check for NULL io_br_sel when putting a buffer - io_uring/kbuf: enable bundles for incrementally consumed buffers - io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths - io_uring/kbuf: use READ_ONCE() for userspace-mapped memory - io_uring/kbuf: use WRITE_ONCE() for userspace-shared buffer ring fields - io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF - io_uring/kbuf: propagate BUF_MORE through early buffer commit path - HID: logitech-hidpp: Enable MX Master 4 over bluetooth - wifi: mac80211: check tdls flag in ieee80211_tdls_oper - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - atm: lec: fix use-after-free in sock_def_readable() - btrfs: don't take device_list_mutex when querying zone info - tg3: replace placeholder MAC address with device property - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure - HID: multitouch: Check to ensure report responses match the request - btrfs: reserve enough transaction items for qgroup ioctls - [arm64,armhf] i2c: tegra: Don't mark devices with pins as IRQ safe - btrfs: reject root items with drop_progress and zero drop_level - [arm64] spi: geni-qcom: Check DMA interrupts early in ISR - dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning - wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session - [arm64,armhf] crypto: caam - fix DMA corruption on long hmac keys - [arm64,armhf] crypto: caam - fix overflow on long hmac keys - crypto: af-alg - fix NULL pointer dereference in scatterwalk - [arm64,armhf] net: fec: fix the PTP periodic output sysfs interface - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak - net/ipv6: ioam6: prevent schema length wraparound in trace fill - tg3: Fix race for querying speed/duplex - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() - bridge: br_nd_send: linearize skb before parsing ND options - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() - net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta - [arm64] net: enetc: check whether the RSS algorithm is Toeplitz - ipv6: prevent possible UaF in addrconf_permanent_addr() - net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue() - net: introduce mangleid_features - net: use skb_header_pointer() for TCPv4 GSO frag_off check - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak - NFC: pn533: bound the UART receive buffer - ASoC: Intel: boards: fix unmet dependency on PINCTRL - bpf: Fix regsafe() for pointers to packet - net: ipv6: flowlabel: defer exclusive option free until RCU teardown - netfilter: flowtable: strictly check for maximum number of actions - netfilter: nfnetlink_log: account for netlink header size - netfilter: x_tables: ensure names are nul-terminated - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr - netfilter: nf_conntrack_helper: pass helper to expect cleanup - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent - netfilter: nf_conntrack_expect: honor expectation helper field - netfilter: nf_conntrack_expect: use expect->helper - netfilter: nf_conntrack_expect: store netns and zone in expectation - netfilter: ctnetlink: ignore explicit helper on new expectations - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP - netfilter: nf_tables: reject immediate NF_QUEUE verdict - Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate - Bluetooth: SCO: fix race conditions in sco_sock_connect() - Bluetooth: MGMT: validate LTK enc_size on load - Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync - Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt - Bluetooth: MGMT: validate mesh send advertising payload length - rds: ib: reject FRMR registration before IB connection is established - bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). - net/sched: sch_netem: fix out-of-bounds access in packet corruption - net: macb: fix clk handling on PCI glue driver removal - net: macb: properly unregister fixed rate clocks - net/mlx5: lag: Check for LAG device before creating debugfs - net/mlx5: Avoid "No data available" when FW version queries fail - net/mlx5: Fix switchdev mode rollback in case of failure - bnxt_en: Restore default stat ctxs for ULP when resource is available - net/x25: Fix potential double free of skb - net/x25: Fix overflow when accumulating packets - net/sched: cls_fw: fix NULL pointer dereference on shared blocks - net/sched: cls_flow: fix NULL pointer dereference on shared blocks - net: hsr: fix VLAN add unwind on slave errors - ipv6: avoid overflows in ip6_datagram_send_ctl() - bpf: reject direct access to nullable PTR_TO_BUF pointers - Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" - iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one - hwmon: (pxe1610) Check return value of page-select write in probe - hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS") - dt-bindings: gpio: fix microchip #interrupt-cells - hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify() - [armhf] hwmon: (occ) Fix missing newline in occ_show_extended() - sched/fair: Use protect_slice() instead of direct comparison - sched/fair: Fix zero_vruntime tracking fix - [amd64,arm64] drm/ioc32: stop speculation on the drm_compat_ioctl path - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation - wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() - USB: serial: option: add MeiG Smart SRM825WN - ALSA: caiaq: fix stack out-of-bounds read in init_card - ALSA: ctxfi: Fix missing SPDIFI1 index handling - io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() - Bluetooth: SMP: derive legacy responder STK authentication from MITM state - Bluetooth: SMP: force responder MITM requirements before building the pairing response - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync - ksmbd: fix OOB write in QUERY_INFO for compound requests - [armhf] hwmon: (occ) Fix division by zero in occ_show_power_1() - drm/amdgpu: fix the idr allocation flags - iio: adc: ti-adc161s626: fix buffer read on big-endian - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() - drm/ast: dp501: Fix initialization of SCU2C - [amd64] drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode - [amd64] drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP - drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB - drm/amdgpu/pm: drop SMU driver if version not matched messages - USB: serial: io_edgeport: add support for Blackbox IC135A - USB: serial: option: add support for Rolling Wireless RW135R-GL - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam - Input: synaptics-rmi4 - fix a locking bug in an error path - Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table - Input: bcm5974 - recover from failed mode switch - Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode - Input: xpad - add support for Razer Wolverine V3 Pro - iio: adc: aspeed: clear reference voltage bits before configuring vref - iio: accel: fix ADXL355 temperature signature value - iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0 - iio: dac: ad5770r: fix error return in ad5770r_read_raw() - iio: light: vcnl4035: fix scan buffer on big-endian - iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin() - iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only - iio: gyro: mpu3050: Fix incorrect free_irq() variable - iio: gyro: mpu3050: Fix irq resource leak - iio: gyro: mpu3050: Move iio_device_register() to correct location - iio: gyro: mpu3050: Fix out-of-sequence free_irq() - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive - usb: ulpi: fix double free in ulpi_register_interface() error path - usb: usbtmc: Flush anchored URBs in usbtmc_release - usb: ehci-brcm: fix sleep during atomic - usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop() - usb: core: phy: avoid double use of 'usb3-phy' - usb: cdns3: gadget: fix NULL pointer dereference in ep_queue - usb: cdns3: gadget: fix state inconsistency on gadget init failure - bridge: br_nd_send: validate ND option lengths - cdc-acm: new quirk for EPSON HMD - [amd64] comedi: Reinit dev->spinlock between attachments to low-level drivers - [amd64] comedi: me_daq: Fix potential overrun of firmware buffer - [amd64] comedi: me4000: Fix potential overrun of firmware buffer - [riscv64] firmware: microchip: fail auto-update probe if no flash found - dt-bindings: connector: add pd-disable dependency - nvmem: imx: assign nvmem_cell_info::raw_len - nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy - netfilter: ipset: drop logically empty buckets in mtype_del - vxlan: validate ND option lengths in vxlan_na_create - net: ftgmac100: fix ring allocation unwind on open failure - [arm64] net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path - gpio: mxc: map Both Edge pad wakeup to Rising Edge - thermal: core: Fix thermal zone device registration error path - misc: fastrpc: possible double-free of cctx->remote_heap - [amd64] thunderbolt: Fix property read in nhi_wake_supported() - USB: dummy-hcd: Fix locking/synchronization error - USB: dummy-hcd: Fix interrupt synchronization error - usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer - usb: typec: ucsi: validate connector number in ucsi_notify_common() - ice: Fix memory leak in ice_set_ringparam() (CVE-2026-23389) - btrfs: fix the qgroup data free range for inline data extents - btrfs: do not free data reservation in fallback from inline due to -ENOSPC (CVE-2025-71269) - usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo - usb: gadget: uvc: fix NULL pointer dereference during unbind race - usb: gadget: f_subset: Fix unbalanced refcnt in geth_free - usb: gadget: f_rndis: Protect RNDIS options with mutex - usb: gadget: f_ecm: Fix net_device lifecycle with device_move - usb: gadget: f_eem: Fix net_device lifecycle with device_move - usb: gadget: f_subset: Fix net_device lifecycle with device_move - usb: gadget: f_rndis: Fix net_device lifecycle with device_move - usb: gadget: f_hid: move list and spinlock inits from bind to alloc - usb: gadget: f_uac1_legacy: validate control request size - wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free - spi: cadence-qspi: Fix exec_mem_op error handling - net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback - [amd64,arm64] net: mana: fix use-after-free in add_adev() error path - scsi: target: tcm_loop: Drain commands in target_reset handler - [amd64] x86/fred: Fix early boot failures on SEV-ES/SNP guests - mm/huge_memory: fix folio isn't locked in softleaf_to_folio() - mm: replace READ_ONCE() with standard page table accessors - mm/memory: fix PMD/PUD checks in follow_pfnmap_start() - drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13 - ext4: publish jinode after initialization - [s390x] perf_cpum_sf: Convert to use try_cmpxchg128() - [s390x] cpum_sf: Cap sampling rate to prevent lsctl exception - MPTCP: fix lock class name family in pm_nl_create_listen_socket - [amd64] x86/CPU/AMD: Add additional fixed RDSEED microcode revisions - drm/amd/amdgpu: decouple ASPM with pcie dpm - drm/amd/amdgpu: disable ASPM in some situations - drm/amd/display: Disable fastboot on DCE 6 too - drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4 - drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming. - drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15% - drm/amd/display: Disable scaling on DCE6 for now - drm/amd: Disable ASPM on SI - drm/amd/display: Correct logic check error for fastboot - bpf: Improve bounds when s64 crosses sign boundary - bpf: Add third round of bounds deduction - bpf: Fix u32/s32 bounds when ranges cross min/max boundary https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.82 - lib/crypto: chacha: Zeroize permuted_state before it leaves scope - usb: typec: ucsi: skip connector validation before init - wifi: rt2x00usb: fix devres lifetime - xfrm_user: fix info leak in build_report() - net: rfkill: prevent unlimited numbers of rfkill events from being created - mptcp: fix slab-use-after-free in __inet_lookup_established - seg6: separate dst_cache for input and output paths in seg6 lwtunnel - Input: uinput - fix circular locking dependency with ff-core - Input: uinput - take event lock when submitting FF request "event" - ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() - btrfs: make wait_on_extent_buffer_writeback() static inline - btrfs: remove unused define WAIT_PAGE_LOCK for extent io - btrfs: split waiting from read_extent_buffer_pages(), drop parameter wait - btrfs: remove unused flag EXTENT_BUFFER_READAHEAD - btrfs: remove unused flag EXTENT_BUFFER_CORRUPT - btrfs: remove pointless out labels from extent-tree.c - btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() - blktrace: fix __this_cpu_read/write in preemptible context - nfc: nci: complete pending data exchange on device close - misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe - Revert "mptcp: add needs_id for netlink appending addr" - net: annotate data-races around sk->sk_{data_ready,write_space} - netfilter: nft_ct: fix use-after-free in timeout object destroy - workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works - xfrm: clear trailing padding in build_polexpire() - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG - wifi: brcmsmac: Fix dma_free_coherent() size - [amd64] platform/x86/intel-uncore-freq: Handle autonomous UFS status bit - [arm64] Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower" - [arm64] dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V - [arm64] dts: hisilicon: poplar: Correct PCIe reset GPIO polarity - [arm64] dts: hisilicon: hi3798cv200: Add missing dma-ranges - nfc: pn533: allocate rx skb before consuming bytes - batman-adv: reject oversized global TT response buffers - X.509: Fix out-of-bounds access when parsing extensions - [amd64,arm64] EDAC/mc: Fix error path ordering in edac_mc_alloc() - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption - batman-adv: hold claim backbone gateways by reference - [amd64] drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat - [amd64] drm/i915/psr: Do not use pipe_src as borders for SU area - net/mlx5: Update the list of the PCI supported devices - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled - mmc: vub300: fix NULL-deref on disconnect - net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure - net: stmmac: fix integer underflow in chain mode - mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() - [amd64,arm64] idpf: improve locking around idpf_vc_xn_push_free() - [amd64,arm64] idpf: set the payload size before calling the async handler - rxrpc: Fix anonymous key handling - rxrpc: Fix call removal to use RCU safe deletion - rxrpc: Fix key reference count leak from call->key - rxrpc: Only put the call ref if one was acquired - rxrpc: reject undecryptable rxkad response tickets - rxrpc: fix reference count leak in rxrpc_server_keyring() - rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) - rxrpc: Fix missing error checks for rxkad encryption/decryption failure - net: skb: fix cross-cache free of KFENCE-allocated skb head - ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 - [amd64] x86/CPU: Fix FPDSS on Zen1 (CVE-2026-31628) https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.83 - RDMA/irdma: Fix double free related to rereg_user_mr - [amd64] ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA - ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk - ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC - [arm64,armhf] media: rkvdec: reduce stack usage in rkvdec_init_v4l2_vp9_count_tbl() - ALSA: asihpi: avoid write overflow check warning - Bluetooth: hci_sync: annotate data-races around hdev->req_status - [amd64] ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF - [amd64,arm64] ASoC: SOF: topology: reject invalid vendor array size in token parser - can: mcp251x: add error handling for power enable in open and resume - [amd64] platform/x86: asus-nb-wmi: add DMI quirk for ASUS ROG Flow Z13-KJP GZ302EAC - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() - ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx - drm/amdgpu: Handle GPU page faults correctly on non-4K page systems - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry - ALSA: hda/realtek: add quirk for Framework F111:000F - wifi: wl1251: validate packet IDs before indexing tx_frames - ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list - ALSA: hda/realtek: Add quirk for Samsung Book2 Pro 360 (NP950QED) - ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - [amd64] ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IMH9 - [amd64] pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) - [amd64] platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug - HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 - HID: roccat: fix use-after-free in roccat_report_event - ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 - wifi: brcmfmac: validate bsscfg indices in IF events - net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules - [armhf] ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J - [armhf] soc: aspeed: socinfo: Mask table entries for accurate SoC ID matching - [arm64] dts: qcom: hamoa/x1: fix idle exit latency - [arm64] dts: imx8mq: Set the correct gpu_ahb clock frequency - [arm64] dts: imx93-9x9-qsb: change usdhc tuning step for eMMC and SD - [arm64] dts: imx93-tqma9352: improve eMMC pad configuration - [arm64] soc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei - tools/power/turbostat: Fix microcode patch level output for AMD/Hygon - PCI: hv: Set default NUMA node to 0 for devices without affinity info - HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP - xfrm: account XFRMA_IF_ID in aevent size calculation - [arm*] drm/vc4: Release runtime PM reference after binding V3D - [arm*] drm/vc4: Fix memory leak of BO array in hang state - [arm*] drm/vc4: Fix a memory leak in hang state error path - [arm* drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock - eventpoll: defer struct eventpoll free to RCU grace period - net: sched: act_csum: validate nested VLAN headers - net: lapbether: handle NETDEV_PRE_TYPE_CHANGE - ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (CVE-2026-31531) - ipv4: icmp: fix null-ptr-deref in icmp_build_probe() - net: increase IP_TUNNEL_RECURSION_LIMIT to 5 - nfc: s3fwrn5: allocate rx skb before consuming bytes - net: stmmac: Fix PTP ref clock for Tegra234 - dt-bindings: net: Fix Tegra234 MGBE PTP clock - tracing/probe: reject non-closed empty immediate strings - ixgbevf: add missing negotiate_features op to Hyper-V ops table - e1000: check return value of e1000_read_eeprom - xsk: tighten UMEM headroom validation to account for tailroom and min frame - xsk: respect tailroom for ZC setups - xsk: fix XDP_UMEM_SG_FLAG issues - xsk: validate MTU against usable frame size on bind - xfrm: Wait for RCU readers during policy netns exit - xfrm: fix refcount leak in xfrm_migrate_policy_find - xfrm_user: fix info leak in build_mapping() - ipvs: fix NULL deref in ip_vs_add_service error path - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator - netfilter: xt_multiport: validate range encoding in checkentry - netfilter: ip6t_eui64: reject invalid MAC header for all packets - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation - netfilter: nfnetlink_queue: make hash table per queue - net: txgbe: leave space for null terminators on property_entry - af_unix: read UNIX_DIAG_VFS data under unix_state_lock - net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ - net: ipa: fix event ring index not programmed for IPA v5.0+ - l2tp: Drop large packets with UDP encap - gpio: tegra: fix irq_release_resources calling enable instead of disable - crypto: af_alg - limit RX SG extraction by receive buffer budget - [amd64] perf/x86/intel/uncore: Skip discovery table for offline dies - sched/deadline: Use revised wakeup rule for dl_server - crypto: algif_aead - Fix minimum RX size check for decryption - netfilter: conntrack: add missing netlink policy validations (CVE-2026-31407) - Revert "drm/xe/mmio: Avoid double-adjust in 64-bit reads" - Revert "drm/xe: Switch MMIO interface to take xe_mmio instead of xe_gt" - thermal: core: Mark thermal zones as exiting before unregistration - thermal: core: Address thermal zone removal races with resume - ALSA: usb-audio: Improve Focusrite sample rate filtering - [amd64,arm64] idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling - nfc: llcp: add missing return after LLCP_CLOSED checks - can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532) - i2c: s3c24xx: check the size of the SMBUS message before using it - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() - HID: alps: fix NULL pointer dereference in alps_raw_event() - HID: core: clamp report_size in s32ton() to avoid undefined shift - net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler - [arm*] drm/vc4: platform_get_irq_byname() returns an int - ALSA: fireworks: bound device-supplied status before string array lookup - fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() - usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() - usb: gadget: renesas_usb3: validate endpoint index in standard request handlers - smb: client: fix off-by-8 bounds check in check_wsl_eas() - ksmbd: validate EaNameLength in smb2_get_ea() - ksmbd: require 3 sub-authorities before reading sub_auth[2] - ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc - usbip: validate number_of_packets in usbip_pack_ret_submit() - usb: storage: Expand range of matched versions for VL817 quirks entry - USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen - usb: gadget: f_hid: don't call cdev_init while cdev in use - usb: port: add delay after usb_hub_set_port_power() - fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO - scripts: generate_rust_analyzer.py: avoid FD leak - wifi: rtw88: fix device leak on probe failure - staging: sm750fb: fix division by zero in ps_to_hz() - USB: serial: option: add Telit Cinterion FN990A MBIM composition - Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race - ALSA: ctxfi: Limit PTP to a single page - dcache: Limit the minimal number of bucket to two - media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections - ocfs2: fix possible deadlock between unlink and dio_end_io_write - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY - ocfs2: handle invalid dinode in ocfs2_group_extend - PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup - [amd64] KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU - [amd64] KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created - [amd64] KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION - gpiolib: unify two loops initializing GPIO descriptors - gpiolib: fix race condition for gdev->srcu (CVE-2026-22986) - net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() - kernel: be more careful about dup_mmap() failures and uprobe registering - KVM: Remove subtle "struct kvm_stats_desc" pseudo-overlay - [amd64] KVM: x86: Use __DECLARE_FLEX_ARRAY() for UAPI structures with VLAs - checkpatch: add support for Assisted-by tag - [amd64] x86-64: rename misleadingly named '__copy_user_nocache()' function - [amd64] x86: rename and clean up __copy_from_user_inatomic_nocache() - x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache - [amd64] KVM: x86: Use scratch field in MMIO fragment to hold small write values - [arm64] ASoC: qcom: q6apm: move component registration to unmanaged version - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() - media: vidtv: fix nfeeds state corruption on start_streaming failure - media: mediatek: vcodec: fix use-after-free in encoder release path - media: em28xx: fix use-after-free in em28xx_v4l2_open() - hwmon: (powerz) Fix use-after-free on USB disconnect - ALSA: 6fire: fix use-after-free on disconnect - bcache: fix cached_dev.sb_bio use-after-free and crash - media: as102: fix to not free memory after the device is registered in as102_usb_probe() - nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map - media: vidtv: fix pass-by-value structs causing MSAN warnings - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() - ocfs2: validate inline data i_size during inode read - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline - rxrpc: Fix key quota calculation for multitoken keys - PCI: Fix placement of pci_save_state() in pci_bus_add_device() - ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442) - PCI: Revert "Enable ACS after configuring IOMMU for OF platforms" https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.84 - mm/userfaultfd: fix hugetlb fault mutex hash calculation - PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown - ima: verify if the segment size has changed - ima: do not copy measurement list to kdump kernel - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure - [arm64] net: ethernet: mtk_eth_soc: initialize PPE per-tag-layer MTU registers - drm/amdgpu: replace PASID IDR with XArray - mm/pagewalk: fix race between concurrent split and refault - ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger - scripts/dtc: Remove unused dts_version in dtc-lexer.l - rxrpc: only handle RESPONSE during service challenge - fs/ntfs3: validate rec->used in journal-replay file record check - f2fs: fix to avoid memory leak in f2fs_rename() - fuse: reject oversized dirents in page cache - fuse: Check for large folio with SPLICE_F_MOVE - fuse: quiet down complaints in fuse_conn_limit_write - ksmbd: require minimum ACE size in smb_check_perm_dacl() - smb: server: fix active_num_conn leak on transport allocation failure - smb: server: fix max_connections off-by-one in tcp accept path - smb: client: require a full NFS mode SID before reading mode bits - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path - ksmbd: validate response sizes in ipc_validate_msg() - ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() - ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - ksmbd: use check_add_overflow() to prevent u16 DACL size overflow - f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() - ALSA: usb-audio: apply quirk for MOONDROP JU Jiu - ALSA: caiaq: take a reference on the USB device in create_card() - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() - [amd64] crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed - [amd64] crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed - [amd64] crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.85 - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) - Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786) -- Salvatore Bonaccorso Thu, 30 Apr 2026 13:38:11 +0200 linux (6.12.74-2~bpo12+1) bookworm-backports; urgency=high * Rebuild for bookworm-backports -- Ben Hutchings Fri, 13 Mar 2026 15:32:42 +0100 linux (6.12.74-2) trixie-security; urgency=high * Refresh patchset to address multiple vulnerabilities in AppArmor -- Salvatore Bonaccorso Sun, 08 Mar 2026 20:54:04 +0100 linux (6.12.74-1) trixie-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.74 - scsi: qla2xxx: Fix bsg_done() causing double free - bnxt_en: Change FW message timeout warning - bnxt_en: hide CONFIG_DETECT_HUNG_TASK specific code - [arm64] bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions - [arm64] bus: fsl-mc: fix use-after-free in driver_override_show() (CVE-2026-23221) - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU - [amd64] ASoC: amd: yc: Add ASUS ExpertBook PM1503CDA to quirks list - ALSA: hda/realtek: Add quirk for Inspur S14-G1 - ALSA: hda/realtek - fixed speaker no sound - romfs: check sb_set_blocksize() return value - [arm64,armhf] drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used - [amd64] platform/x86: classmate-laptop: Add missing NULL pointer checks - [amd64] ASoC: Intel: sof_es8336: Add DMI quirk for Huawei BOD-WXX9 - [amd64] ASoC: amd: yc: Add quirk for HP 200 G2a 16 - ALSA: hda/realtek: Enable headset mic for Acer Nitro 5 - [amd64] platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Pro - [amd64] platform/x86: panasonic-laptop: Fix sysfs group leak in error path - [amd64] ASoC: cs42l43: Correct handling of 3-pole jack load detection - tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow - drm/amd/display: extend delta clamping logic to CM3 LUT helper - drm/amd/display: remove assert around dpp_base replacement - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count - mm/hugetlb: fix hugetlb_pmd_shared() (CVE-2026-23100) - mm/hugetlb: fix two comments related to huge_pmd_unshare() - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather - Revert "wireguard: device: enable threaded NAPI" - cpuset: Fix missing adaptation for cpuset_is_populated - fbdev: smscufx: properly copy ioctl memory to kernelspace - f2fs: fix to add gc count stat in f2fs_gc_range - f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly - f2fs: fix out-of-bounds access in sysfs attribute read/write - f2fs: fix to avoid mapping wrong physical block for swapfile - [arm64] iommu/arm-smmu-qcom: do not register driver in probe() - f2fs: fix to avoid UAF in f2fs_write_end_io() - f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes - USB: serial: option: add Telit FN920C04 RNDIS compositions [ Simone Weiß ] * db-mok: Remove unused function, fixing compilation warning [ Ben Hutchings ] * CI: Delete support for ccache, which was removed from common pipeline * CI: Update build job to work after another common pipeline change [ Salvatore Bonaccorso ] * apparmor: validate DFA start states are in bounds in unpack_pdb * apparmor: fix memory leak in verify_header * apparmor: replace recursive profile removal with iterative approach * apparmor: fix side-effect bug in match_char() macro usage * apparmor: fix missing bounds check on DEFAULT table in verify_dfa() * apparmor: Fix double free of ns_name in aa_replace_profiles() * apparmor: unprivileged local user can privilge escalate policy management * apparmor: fix differential encoding verification * apparmor: fix race on rawdata dereference -- Salvatore Bonaccorso Sun, 01 Mar 2026 13:47:48 +0100 linux (6.12.73-1~bpo12+1) bookworm-backports; urgency=medium * Rebuild for bookworm-backports -- Ben Hutchings Sat, 21 Feb 2026 01:02:57 +0100 linux (6.12.73-1) trixie-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.70 - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec - [amd64] x86/vmware: Fix hypercall clobbers - [amd64] x86/kfence: fix booting on 32bit non-PAE systems - [amd64] platform/x86: intel_telemetry: Fix swapped arrays in PSS output - ALSA: aloop: Fix racy access at PCM trigger - [arm64] pmdomain: qcom: rpmpd: fix off-by-one error in clamping to the highest state - [arm64] pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeup - [arm64,armhf] pmdomain: imx: gpcv2: Fix the imx8mm gpu hang due to wrong adb400 reset - [arm64] pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeup - [arm64] pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single - ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Closes: #1125405) - rbd: check for EOD after exclusive lock is ensured to be held - ceph: fix oops due to invalid pointer for kfree() in parse_longname() - gve: Fix stats report corruption on queue count change - gve: Correct ethtool rx_dropped calculation - mm, shmem: prevent infinite loop on truncate race - Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" - KVM: Don't clobber irqfd routing type when deassigning irqfd - PCI/ERR: Ensure error recoverability at all times - ublk: fix deadlock when reading partition table (CVE-2025-68823) - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (CVE-2025-40082) - [arm*] binder: fix BR_FROZEN_REPLY error log - binderfs: fix ida_alloc_max() upper bound - procfs: avoid fetching build ID while holding VMA lock - tracing: Fix ftrace event field alignments - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined - wifi: wlcore: ensure skb headroom before skb_push - net: usb: sr9700: support devices with virtual driver CD - block,bfq: fix aux stat accumulation destination - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() - md: suspend array while updating raid_disks via sysfs - smb/server: fix refcount leak in smb2_open() - smb/server: fix refcount leak in parse_durable_handle_context() - [amd64] HID: intel-ish-hid: Update ishtp bus match to support device ID table - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL - btrfs: fix reservation leak in some error paths when inserting inline extent - [riscv64] Sanitize syscall table indexing under speculation - [amd64] HID: intel-ish-hid: Reset enum_devices_done before enumeration - HID: playstation: Center initial joystick axes to prevent spurious events - ALSA: hda/realtek: Add quirk for Acer Nitro AN517-55 - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk - [arm64] PCI: qcom: Remove ASPM L0s support for MSM8996 SoC - netfilter: replace -EEXIST with -EBUSY - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free - HID: logitech: add HID++ support for Logitech MX Anywhere 3S - wifi: mac80211: collect station statistics earlier when disconnect - ASoC: simple-card-utils: Check device node before overwrite direction - nvme-fc: release admin tagset if init fails - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() - [amd64] ASoC: amd: yc: Fix microphone on ASUS M6500RE - regmap: maple: free entry on mas_store_gfp() failure - wifi: cfg80211: Fix bitrate calculation overflow for HE rates - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() - wifi: mac80211: correctly check if CSA is active - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice - btrfs: reject new transactions if the fs is fully read-only - ALSA: hda/realtek: ALC269 fixup for Lenovo Yoga Book 9i 13IRU8 audio - [amd64] platform/x86: toshiba_haps: Fix memory leaks in add/remove routines - [amd64] platform/x86: intel_telemetry: Fix PSS event register mask - [amd64] platform/x86: hp-bioscfg: Skip empty attribute names - [amd64] platform/x86/intel/tpmi/plr: Make the file domain/status writeable - smb/client: fix memory leak in smb2_open_file() - net: add skb_header_pointer_careful() helper - net/sched: cls_u32: use skb_header_pointer_careful() - net: liquidio: Initialize netdev pointer before queue setup - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup - net: phy: add phy_interface_weight() - net: phy: add phy_interface_copy() - net: sfp: pre-parse the module support - net: sfp: convert sfp quirks to modify struct sfp_module_support - net: sfp: Fix quirk for Ubiquiti U-Fiber Instant SFP module - macvlan: fix error recovery in macvlan_common_newlink() - net: usb: r8152: fix resume reset deadlock - net: don't touch dev->stats in BPF redirect paths - tipc: use kfree_sensitive() for session key material - drm/amd/display: fix wrong color value mapping on MCM shaper LUT - net: gro: fix outer network offset - [amd64] drm/mgag200: fix mgag200_bmc_stop_scanout() - drm/xe/query: Fix topology query pointer advance - drm/xe/pm: Also avoid missing outer rpm warning on system suspend - drm/xe/pm: Disable D3Cold for BMG only on specific platforms - [armhf] hwmon: (occ) Mark occ_init_attribute() as __printf - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF - ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() - [amd64] ASoC: amd: fix memory leak in acp3x pdm dma ops - [arm64] ipi: tegra: Fix a memory leak in tegra_slink_probe() - [arm64,armhf] spi: tegra114: Preserve SPI mode bits in def_command1_reg - ALSA: hda/realtek: Really fix headset mic for TongFang X6AR55xU. - gpiolib-acpi: Update file references in the Documentation and MAINTAINERS https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.71 - net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Closes: #1127597) - io_uring/rw: recycle buffers manually for non-mshot reads https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.72 - smb: client: split cached_fid bitfields to avoid shared-byte RMW races - ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() - driver core: enforce device_lock for driver_match_device() - Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB - [amd64] crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode - [armhf] crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly - crypto: virtio - Add spinlock protection with virtqueue notification - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req - nilfs2: Fix potential block overflow that cause system hang - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() - scsi: qla2xxx: Validate sp before freeing associated memory - scsi: qla2xxx: Allow recovery for tape devices - scsi: qla2xxx: Delay module unload while fabric scan in progress - scsi: qla2xxx: Free sp in error path to fix system crash - scsi: qla2xxx: Query FW again before proceeding with login - bus: mhi: host: pci_generic: Add Telit FE990B40 modem support - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169) - erofs: fix UAF issue for file-backed mounts w/ directio option - xfs: fix UAF in xchk_btree_check_block_owner - PCI: endpoint: Avoid creating sub-groups asynchronously - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add - [armhf] gpio: omap: do not register driver in probe() https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.73 - Revert "driver core: enforce device_lock for driver_match_device()" -- Salvatore Bonaccorso Tue, 17 Feb 2026 06:47:26 +0100 linux (6.12.69-1~bpo12+1) bookworm-backports; urgency=medium * Rebuild for bookworm-backports -- Ben Hutchings Mon, 09 Feb 2026 22:52:52 +0100 linux (6.12.69-1) trixie-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.64 - btrfs: do not skip logging new dentries when logging a new name - btrfs: fix a potential path leak in print_data_reloc_error() - [arm64] bpf, arm64: Do not audit capability check in do_jit() - btrfs: fix memory leak of fs_devices in degraded seed device path - shmem: fix recovery on rename failures - iomap: adjust read range correctly for non-block-aligned positions - iomap: account for unaligned end offsets when truncating read range - scripts/faddr2line: Fix "Argument list too long" error - [amd64] perf/x86/amd: Check event before enable to avoid GPF - sched/deadline: only set free_cpus for online runqueues - sched/fair: Revert max_newidle_lb_cost bump - [amd64] x86/ptrace: Always inline trivial accessors - ACPICA: Avoid walking the Namespace if start_node is NULL - ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only - cpufreq: dt-platdev: Add JH7110S SOC to the allowlist - ACPI: fan: Workaround for 64-bit firmware bug - cpuidle: menu: Use residency threshold in polling state override decisions - livepatch: Match old_sympos 0 and 1 in klp_find_func() - fs/ntfs3: Support timestamps prior to epoch - kbuild: Use objtree for module signing key path - ntfs: set dummy blocksize to read boot_block when mounting - hfsplus: fix volume corruption issue for generic/070 - hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create - hfsplus: Verify inode mode when loading from disk - hfsplus: fix volume corruption issue for generic/073 - fs/ntfs3: check for shutdown in fsync - wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU - wifi: cfg80211: stop radar detection in cfg80211_leave() - wifi: cfg80211: use cfg80211_leave() in iftype change - wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load - wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet - btrfs: scrub: always update btrfs_scrub_progress::last_physical - gfs2: fix remote evict for read-only filesystems - gfs2: Fix "gfs2: Switch to wait_event in gfs2_quotad" - smb/server: fix return value of smb2_ioctl() - ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency - ksmbd: vfs: fix race on m_flags in vfs_cache - Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV - Bluetooth: btusb: MT7922: Add VID/PID 0489/e170 - Bluetooth: btusb: MT7920: Add VID/PID 0489/e135 - Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE - Bluetooth: btusb: Add new VID/PID 0x0489/0xE12F for RTL8852BE-VT - gfs2: Fix use of bio_chain - [arm64,armhf] net: fec: ERR007885 Workaround for XDP TX path - netrom: Fix memory leak in nr_sendmsg() - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change - ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2() - bnxt_en: Fix XDP_TX path - net: openvswitch: fix middle attribute validation in push_nsh() action - broadcom: b44: prevent uninitialized value usage - netfilter: nf_conncount: fix leaked ct in error paths - ipvs: fix ipv4 null-ptr-deref in route error path - net/sched: ets: Remove drr class from the active list if it changes to strict - nfc: pn533: Fix error code in pn533_acr122_poweron_rdr() - netfilter: nf_nat: remove bogus direction check - netfilter: nf_tables: remove redundant chain validation on register store - ethtool: Avoid overflowing userspace buffer on stats query - net/mlx5: fw reset, clear reset requested on drain_fw_reset - net/mlx5: Drain firmware reset in shutdown callback - net/mlx5: fw_tracer, Validate format string parameters - net/mlx5: fw_tracer, Handle escaped percent properly - net/mlx5: Serialize firmware reset with devlink - net/handshake: duplicate handshake cancellations leak socket - [arm64] net: enetc: do not transmit redirected XDP frames when the link is down - [arm64] net: hns3: using the num_tqps in the vf driver to apply for resources - [arm64] net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx - [arm64] net: hns3: add VLAN id validation before using - [amd64] hwmon: (dell-smm) Limit fan multiplier to avoid overflow - hwmon: (ibmpex) fix use-after-free in high/low store - hwmon: (tmp401) fix overflow caused by default conversion rate value - drm/me/gsc: mei interrupt top half should be in irq disabled context - drm/xe: Restore engine registers before restarting schedulers after GT reset - drm/panel: sony-td4353-jdi: Enable prepare_prev_first - [amd64] x86/xen: Move Xen upcall handler - [amd64] x86/xen: Fix sparse warning in enlighten_pv.c - [arm64] kdump: Fix elfcorehdr overlap caused by reserved memory processing reorder - spi: cadence-quadspi: Fix clock disable on probe failure path - block: rnbd-clt: Fix leaked ID in init_dev() - drm/xe: Limit num_syncs to prevent oversized allocations - drm/xe/oa: Limit num_syncs to prevent oversized allocations - ksmbd: skip lock-range check on equal size to avoid size==0 underflow - ksmbd: Fix refcount leak when invalid session is found on session lookup - ksmbd: fix buffer validation by including null terminator size in EA length - HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation - Input: lkkbd - disable pending work before freeing device - Input: alps - fix use-after-free bugs caused by dev3_register_work - Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table - xfs: don't leak a locked dquot when xfs_dquot_attach_buf fails - can: gs_usb: gs_can_open(): fix error handling - [arm64,armhf] soc/tegra: fuse: Do not register SoC device on ACPI boot - ACPI: PCC: Fix race condition by removing static qualifier - ACPI: CPPC: Fix missing PCC check for guaranteed_perf - [arm64] mmc: sdhci-of-arasan: Increase CD stable timeout to 2 seconds - dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml - net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() - [amd64] x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures - ALSA: vxpocket: Fix resource leak in vxpocket_probe error path - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path - ALSA: usb-mixer: us16x08: validate meter packet indices - nfsd: update percpu_ref to manage references on nfsd_net - nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ - nfsd: fix memory leak in nfsd_create_serv error paths - ipmi: Fix the race between __scan_channels() and deliver_response() - ipmi: Fix __scan_channels() failing to rescan channels - [arm64,armhf] ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx - scsi: smartpqi: Add support for Hurray Data new controller PCI device - [arm64] clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4 - scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled - scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive - scsi: qla2xxx: Use reinit_completion on mbx_intr_comp - fuse: Always flush the page cache before FOPEN_DIRECT_IO write - fuse: Invalidate the page cache after FOPEN_DIRECT_IO write - via_wdt: fix critical boot hang due to unnamed resource allocation - reset: fix BIT macro reference - exfat: fix remount failure in different process environments - exfat: zero out post-EOF page cache on file extension - usbip: Fix locking bug in RT-enabled kernels - usb: typec: ucsi: Handle incorrect num_connectors capability - [armhf] iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains - usb: xhci: limit run_graceperiod for only usb 3.0 devices - usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive. - libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map - i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware - nvme-fc: don't hold rport lock when putting ctrl - nvme-fabrics: add ENOKEY to no retry criteria for authentication failures - [amd64] platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks - [amd64] scsi: scsi_debug: Fix atomic write enable module param description - block: rnbd-clt: Fix signedness bug in init_dev() - vhost/vsock: improve RCU read sections around vhost_vsock_get() - cifs: Fix memory and information leak in smb3_reconfigure() - KEYS: trusted: Fix a memory leak in tpm2_load_cmd - io_uring: fix filename leak in __io_openat_prep() - [amd64] x86/mce: Do not clear bank's poll bit in mce_poll_banks on AMD SMCA systems - [arm64] mmc: sdhci-msm: Avoid early clock doubling during HS400 transition - perf: arm_cspmu: fix error handling in arm_cspmu_impl_unregister() - [amd64] lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit - [s390x] dasd: Fix gendisk parent after copy pair swap - wifi: mt76: Fix DTS power-limits on little endian systems - block: rate-limit capacity change info log - floppy: fix for PAGE_SIZE != 4KB - kallsyms: Fix wrong "big" kernel symbol type read from procfs - fs/ntfs3: fix mount failure for sparse runs in run_unpack() - tpm: Cap the number of PCR banks - ext4: fix string copying in parse_apply_sb_mount_options() - ext4: xattr: fix null pointer deref in ext4_raw_inode() - ext4: clear i_state_flags when alloc inode - ext4: fix incorrect group number assertion in mb_check_buddy - ext4: align max orphan file size with e2fsprogs limit - jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key - jbd2: use a weaker annotation in journal handling - media: v4l2-mem2mem: Fix outdated documentation - mptcp: schedule rtx timer only after pushing data - mptcp: avoid deadlock on fallback while reinjecting - usb: usb-storage: Maintain minimal modifications to the bcdDevice range. - media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg() - media: pvrusb2: Fix incorrect variable used in trace message - usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() - [arm64,armhf] usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe - [arm64,armhf] usb: dwc3: keep susphy enabled during exit to avoid controller faults - char: applicom: fix NULL pointer dereference in ac_ioctl - [amd64] intel_th: Fix error handling in intel_th_output_open - mei: gsc: add dependency on Xe driver - serial: sh-sci: Check that the DMA cookie is valid - cpuidle: governors: teo: Drop misguided target residency check - cpufreq: nforce2: fix reference count leak in nforce2 - scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" - scsi: aic94xx: fix use-after-free in device removal path - NFSD: use correct reservation type in nfsd4_scsi_fence_client - scsi: target: Reset t_task_cdb pointer in error case - scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow - scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error - f2fs: ensure node page reads complete before f2fs_put_super() finishes - f2fs: fix to avoid potential deadlock - f2fs: fix to avoid updating zero-sized extent in extent cache - f2fs: invalidate dentry cache on failed whiteout creation - f2fs: fix age extent cache insertion skip on counter overflow - f2fs: fix uninitialized one_time_gc in victim_sel_policy - f2fs: fix return value of f2fs_recover_fsync_data() - KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot - media: vidtv: initialize local pointers upon transfer of memory ownership - ocfs2: fix kernel BUG in ocfs2_find_victim_chain - [amd64] KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI) - [amd64] platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver - scs: fix a wrong parameter in __scs_magic - libceph: make decode_pool() more resilient against corrupted osdmaps - [powerpc*] Add reloc_offset() to font bitmap pointer used for bootx_printf() - [amd64] KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0 - [amd64] KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn() - [amd64] KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer - [amd64] KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE - [amd64] KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN - [amd64] KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation - [amd64] KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN - [amd64] KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit - [amd64] KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) - [amd64] KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits - xfs: fix a memory leak in xfs_buf_item_init() - xfs: fix stupid compiler warning - xfs: fix a UAF problem in xattr repair - tracing: Do not register unsupported perf events - PM: runtime: Do not clear needs_force_resume with enabled runtime PM - r8169: fix RTL8117 Wake-on-Lan in DASH mode - fsnotify: do not generate ACCESS/MODIFY events on child for special files - net/handshake: restore destructor on submit failure - NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap - NFSD: NFSv4 file creation neglects setting ACL - nfsd: Mark variable __maybe_unused to avoid W=1 build break - svcrdma: return 0 on success from svc_rdma_copy_inline_range - svcrdma: use rc_pageoff for memcpy byte offset - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf - [powerpc*] kexec: Enable SMT before waking offline CPUs - btrfs: don't log conflicting inode if it's a dir moved in the current transaction - [s390x] ipl: Clear SBP flag when bootprog is set - gpio: regmap: Fix memleak in error path in gpio_regmap_register() - io_uring/poll: correctly handle io_poll_add() return value on update - io_uring: fix min_wait wakeups for SQPOLL - Revert "drm/amd/display: Fix pbn to kbps Conversion" - drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state() - drm/amd/display: Fix scratch registers offsets for DCN35 - drm/amd/display: Fix scratch registers offsets for DCN351 - drm/displayid: pass iter to drm_find_displayid_extension() - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (CVE-2025-68345) - ALSA: wavefront: Use guard() for spin locks - ALSA: wavefront: Clear substream pointers on close - [arm64] pinctrl: renesas: rzg2l: Fix ISEL restore on resume - hsr: hold rcu and dev lock for hsr_get_port_ndev (CVE-2025-39872) - sched/rt: Fix race in push_rt_task (CVE-2025-38234) - [arm64] KVM: arm64: Initialize HCR_EL2.E2H early - [arm64] KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() - [arm64] Revamp HCR_EL2.E2H RES1 detection - dt-bindings: PCI: qcom,pcie-sc7280: Add missing required power-domains and resets - dt-bindings: PCI: qcom,pcie-sc8280xp: Add missing required power-domains and resets - dt-bindings: PCI: qcom,pcie-sm8150: Add missing required power-domains and resets - dt-bindings: PCI: qcom,pcie-sm8250: Add missing required power-domains and resets - dt-bindings: PCI: qcom,pcie-sm8350: Add missing required power-domains and resets - dt-bindings: PCI: qcom,pcie-sm8450: Add missing required power-domains and resets - dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets - crypto: af_alg - zero initialize memory allocated via sock_kmalloc - crypto: caam - Add check for kcalloc() in test_len() - [arm64,armhf] amba: tegra-ahb: Fix device leak on SMMU enable - virtio: vdpa: Fix reference count leak in octep_sriov_enable() - tracing: Fix fixed array of synthetic event - [arm64,armhf] soc: samsung: exynos-pmu: fix device leak on regmap lookup - [arm64] soc: qcom: ocmem: fix device leak on lookup - [arm64] soc: amlogic: canvas: fix device leak on lookup - rpmsg: glink: fix rpmsg device leak - [amd64] platform/x86: intel: chtwc_int33fe: don't dereference swnode args - i2c: amd-mp2: fix reference leak in MP2 PCI device - hwmon: (max16065) Use local variable to avoid TOCTOU - hwmon: (max6697) fix regmap leak on probe failure - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU - hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU - [amd64] x86/msi: Make irq_retrigger() functional for posted MSI - [arm64] iommu/mediatek: fix use-after-free on probe deferral - fuse: fix readahead reclaim deadlock - wifi: rtw88: limit indirect IO under powered off for RTL8822CS (Closes: #1125797) - wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() - wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() - wifi: mac80211: do not use old MBSSID elements - i40e: fix scheduling in set_rx_mode - i40e: validate ring_len parameter against hardware-specific values - iavf: fix off-by-one issues in iavf_config_rss_reg() - idpf: reduce mbx_task schedule delay to 300us - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt - Bluetooth: btusb: revert use of devm_kzalloc in btusb - net: mdio: aspeed: add dummy read to avoid read-after-write issue - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy - ip6_gre: make ip6gre_header() robust - [amd64] platform/x86: msi-laptop: add missing sysfs_remove_group() - [amd64] platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic - team: fix check for port enabled in team_queue_override_port_prio_changed() - [arm64,armhf] net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() - amd-xgbe: reset retries and mode on RX adapt failures - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure - genalloc.h: fix htmldocs warning - firewire: nosy: Fix dma_free_coherent() size - [armhf] net: dsa: b53: skip multicast entries for fdb_dump() - kbuild: fix compilation of dtb specified on command-line without make rule - net: usb: asix: validate PHY address before use - net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct - vfio/pds: Fix memory leak in pds_vfio_dirty_enable() - [amd64] platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing - [arm64] octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" - net: stmmac: fix the crash issue for zero copy XDP_TX action - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() - ipv4: Fix reference count leak when using error routes with nexthop objects - net: rose: fix invalid array index in rose_kill_by_device() - ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT - RDMA/irdma: avoid invalid read in irdma_net_event - RDMA/efa: Remove possible negative shift - RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() - RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() - RDMA/core: always drop device refcount in ib_del_sub_device_and_put() - RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send - RDMA/bnxt_re: Fix to use correct page size for PDE table - md: Fix static checker warning in analyze_sbs - md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() - ksmbd: Fix memory leak in get_file_all_info() - RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation - RDMA/bnxt_re: fix dma_free_coherent() pointer - blk-mq: skip CPU offline notify on unmapped hctx - ntfs: Do not overwrite uptodate pages - [armhf] ASoC: stm32: sai: fix device leak on probe - [armhf] ASoC: stm32: sai: fix clk prepare imbalance on probe failure - [armhf] ASoC: stm32: sai: fix OF node leak on probe - [arm64] ASoC: codecs: lpass-tx-macro: fix SM6115 support - [arm64] ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr - [arm64] ASoC: qcom: q6asm-dai: perform correct state check before closing - [arm64] ASoC: qcom: q6adm: the the copp device only during last instance - [arm64] ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. - [amd64] iommu/amd: Fix pci_segment memleak in alloc_pci_segment() - [amd64] iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() - [armhf] iommu/omap: fix device leaks on probe_device() - [arm64] iommu/qcom: fix device leak on of_xlate() - [arm64,riscv64] iommu/sun50i: fix device leak on of_xlate() - [arm64,armhf] iommu/tegra: fix device leak on probe_device() - iommu: disable SVA when CONFIG_X86 is set - HID: logitech-dj: Remove duplicate error logging - fgraph: Initialize ftrace_ops->private for function graph ops - fgraph: Check ftrace_pids_enabled on registration for early filtering - PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths - [arm64] dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator - [powerpc*] mm: Fix mprotect on book3s 32-bit - [powerpc*] 64s/slb: Fix SLB multihit issue during SLB preload - leds: leds-cros_ec: Skip LEDs without color components - leds: leds-lp50xx: Allow LED 0 to be added to module bank - leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs - leds: leds-lp50xx: Enable chip before any communication - block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs - [arm64,armhf] clk: samsung: exynos-clkout: Assign .num before accessing .hws (Closes: #1121211) - [arm64] mfd: max77620: Fix potential IRQ chip conflict when probing two devices - media: rc: st_rc: Fix reset control resource leak - media: verisilicon: Fix CPU stalls on G2 bus error - mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions - mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips - mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips - mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips - mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips - mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips - mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips - [amd64] perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error - [powerpc*] pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() - firmware: stratix10-svc: Add mutex in stratix10 memory management - dm-ebs: Mark full buffer dirty even on partial write - dm-bufio: align write boundary on physical block size - fbdev: gbefb: fix to use physical address instead of dma address - fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing - fbdev: tcx.c fix mem_map to correct smem_start offset - media: cec: Fix debugfs leak on bus_register() failure - media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() - media: platform: mtk-mdp3: fix device leaks at probe - media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled - media: samsung: exynos4-is: fix potential ABBA deadlock on init - media: TDA1997x: Remove redundant cancel_delayed_work in probe - media: verisilicon: Protect G2 HEVC decoder against invalid DPB index - media: videobuf2: Fix device reference leak in vb2_dc_alloc error path - media: vpif_capture: fix section mismatch - media: vpif_display: fix section mismatch - media: amphion: Cancel message work before releasing the VPU core - media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe - media: i2c: adv7842: Remove redundant cancel_delayed_work in probe - media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() - [armhf] pmdomain: imx: Fix reference count leak in imx_gpc_probe() - compiler_types.h: add "auto" as a macro for "__auto_type" - lockd: fix vfs_test_lock() calls - idr: fix idr_alloc() returning an ID out of range - mm/page_owner: fix memory leak in page_owner_stack_fops->release() - [amd64] x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo - tools/mm/page_owner_sort: fix timestamp comparison for stable sorting - samples/ftrace: Adjust LoongArch register restore order in direct calls - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly - RDMA/cm: Fix leaking the multicast GID table reference - e1000: fix OOB in e1000_tbi_should_accept() - fjes: Add missing iounmap in fjes_hw_init() - nfsd: Drop the client reference in client_states_open() - net: usb: sr9700: fix incorrect command used to write single register - net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write - net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() - Revert "drm/amd: Skip power ungate during suspend for VPE" - drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling - drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma - drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling - [arm64] drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers - [amd64] drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() - drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident - drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() - [arm64] drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() - [arm64] drm/mediatek: Fix probe resource leaks - [arm64] drm/mediatek: Fix probe memory leak - [arm64] drm/mediatek: Fix probe device leaks - drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace - drm/amdkfd: bump minimum vgpr size for gfx1151 - drm/amdkfd: Trap handler support for expert scheduling mode - [amd64] drm/i915: Fix format string truncation warning - drm/ttm: Avoid NULL pointer deref for evicted BOs - [amd64] drm/mgag200: Fix big-endian support - drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table - drm/xe/oa: Disallow 0 OA property values - drm/xe: Adjust long-running workload timeslices to reasonable values - drm/xe: Use usleep_range for accurate long-running workload timeslicing - drm/xe: Drop preempt-fences when destroying imported dma-bufs. - [arm64] drm/msm/dpu: Add missing NULL pointer check for pingpong interface - [amd64] drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer - drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb - [riscv64] lib/crypto: riscv/chacha: Avoid s0/fp register - gfs2: fix freeze error handling - btrfs: don't rewrite ret from inode_permission - sched/eevdf: Fix min_vruntime vs avg_vruntime - erofs: fix unexpected EIO under memory pressure - sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks - jbd2: fix the inconsistency between checksum and data in memory for journal sb - tty: introduce and use tty_port_tty_vhangup() helper - xhci: dbgtty: fix device unregister: fixup - f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes() - f2fs: use global inline_xattr_slab instead of per-sb slab cache - f2fs: drop inode from the donation list when the last file is closed - f2fs: fix to avoid updating compression context during writeback - serial: core: fix OF node leak - serial: core: Restore sysfs fwnode information - mptcp: pm: ignore unknown endpoint flags - mm/ksm: fix exec/fork inheritance support for prctl - svcrdma: bound check rq_pages index in inline path - block: freeze queue when updating zone resources - tpm2-sessions: Fix tpm2_read_public range checks - sched_ext: Factor out local_dsq_post_enq() from dispatch_enqueue() - sched_ext: Fix missing post-enqueue handling in move_local_task_to_local_dsq() - drm/displayid: add quirk to ignore DisplayID checksum errors - hrtimers: Introduce hrtimer_update_function() - [arm64] serial: xilinx_uartps: Use helper function hrtimer_update_function() - [arm64] serial: xilinx_uartps: fix rs485 delay_rts_after_send - f2fs: clear SBI_POR_DOING before initing inmem curseg - f2fs: add timeout in f2fs_enable_checkpoint() - f2fs: dump more information for f2fs_{enable,disable}_checkpoint() - f2fs: fix to propagate error from f2fs_enable_checkpoint() - gpiolib: acpi: Switch to use enum in acpi_gpio_in_ignore_list() - gpiolib: acpi: Handle deferred list via new API - gpiolib: acpi: Add acpi_gpio_need_run_edge_events_on_boot() getter - gpiolib: acpi: Move quirks to a separate file - gpiolib: acpi: Add a quirk for Acer Nitro V15 - gpiolib: acpi: Add quirk for ASUS ProArt PX13 - gpiolib: acpi: Add quirk for Dell Precision 7780 - netfilter: nft_ct: add seqadj extension for natted connections (CVE-2025-68206) - md/raid10: wait barrier before returning discard request with REQ_NOWAIT (CVE-2025-40325) - [arm64] drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (CVE-2025-40276) - net: ipv6: ioam6: use consistent dst names - ipv6: adopt dst_dev() helper - net: use dst_dev_rcu() in sk_setup_caps() - usbnet: Fix using smp_processor_id() in preemptible code warnings - serial: core: Fix serial device initialization - tty: fix tty_port_tty_*hangup() kernel-doc - [amd64] x86/microcode/AMD: Select which microcode patch to load - media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio - wifi: mt76: mt7925: fix the unfinished command of regd_notifier before suspend - wifi: mt76: mt7925: fix CLC command timeout when suspend/resume - wifi: mt76: mt7925: add handler to hif suspend/resume event - idpf: add support for SW triggered interrupts - idpf: trigger SW interrupt when exiting wb_on_itr mode - idpf: add support for Tx refillqs in flow scheduling mode - idpf: improve when to set RE bit logic - idpf: simplify and fix splitq Tx packet rollback error path - idpf: replace flow scheduling buffer ring with buffer pool - idpf: stop Tx if there are insufficient buffer resources - idpf: remove obsolete stashing code - hrtimers: Make hrtimer_update_function() less expensive - gve: defer interrupt enabling until NAPI registration - block: handle zone management operations completions - soundwire: stream: extend sdw_alloc_stream() to take 'type' parameter - [arm64] ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime - PCI: brcmstb: Reuse pcie_cfg_data structure - PCI: brcmstb: Set MLW based on "num-lanes" DT property if present - PCI: brcmstb: Fix disabling L0s capability - mm/balloon_compaction: we cannot have isolated pages in the balloon list - mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() - [powerpc*] pseries/cmm: adjust BALLOON_MIGRATE when migrating pages - media: mediatek: vcodec: Use spinlock for context list protection lock - media: amphion: Add a frame flush mode for decoder - media: amphion: Make some vpu_v4l2 functions static - media: amphion: Remove vpu_vb_is_codecconfig - vfio/pci: Disable qword access to the PCI ROM bar - iomap: allocate s_dio_done_wq for async reads as well (CVE-2025-68357) - block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.65 - mptcp: fallback earlier on simult connection - mm/page_alloc: change all pageblocks migrate type on coalescing - mm: simplify folio_expected_ref_count() - mm: consider non-anon swap cache folios in folio_expected_ref_count() - mptcp: ensure context reset on disconnect() - wifi: mac80211: Discard Beacon frames to non-broadcast address - [arm64] net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration - drm/amdgpu: Forward VMID reservation errors - [amd64] cpufreq: intel_pstate: Check IDA only before MSR_IA32_PERF_CTL writes - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. - sched/fair: Small cleanup to sched_balance_newidle() - sched/fair: Small cleanup to update_newidle_cost() - sched/fair: Proportional newidle balance - virtio_console: fix order of fields cols and rows - [armhf] pwm: stm32: Always program polarity - [amd64] Revert "iommu/amd: Skip enabling command/event buffers for kdump" https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.66 - NFSD: Fix permission check for read access to executable-only files - nfsd: provide locking for v4_end_grace - nfsd: use correct loop termination in nfsd4_revoke_states() - nfsd: check that server is running in unlock_filesystem - NFSD: net ref data still needs to be freed even if net hasn't startup - NFSD: Remove NFSERR_EAGAIN - atm: Fix dma_free_coherent() size - net: 3com: 3c59x: fix possible null dereference in vortex_probe1() - [arm64] Fix cleared E0POE bit after cpu_suspend()/resume() - btrfs: always detect conflicting inodes when logging inode refs - [amd64] mei: me: add nova lake point S DID - lib/crypto: aes: Fix missing MMU protection for AES S-box - drm/amdgpu: Fix query for VPE block_type and ip_count - drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (Closes: #1122106) - [arm64,armhf] gpio: rockchip: mark the GPIO controller as sleeping - [arm64] pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping - wifi: avoid kernel-infoleak from struct iw_point - wifi: mac80211: restore non-chanctx injection behaviour - libceph: prevent potential out-of-bounds reads in handle_auth_done() - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() - libceph: make free_choose_arg_map() resilient to partial allocation - libceph: return the handler error from mon_handle_auth_done() - libceph: reset sparse-read state in osd_fault() - libceph: make calc_target() set t->paused, not just clear it - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CVE-2025-40149) - drm/xe: make xe_gt_idle_disable_c6() handle the forcewake internally - drm/xe: Ensure GT is in C0 during resumes - dm-snapshot: fix 'scheduling while atomic' on real-time kernels - NFSv4: ensure the open stateid seqid doesn't go backwards - [arm64] ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again) - NFS: Fix up the automount fs_context to use the correct cred - drm/amd/display: shrink struct members - smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value - smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value - smb/client: fix NT_STATUS_NO_DATA_DETECTED value - scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset - scsi: ufs: core: Fix EH failure after W-LUN resume error - scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" - btrfs: fix qgroup_snapshot_quick_inherit() squota bug - btrfs: qgroup: update all parent qgroups when doing quick inherit - btrfs: tracepoints: use btrfs_root_id() to get the id of a root - btrfs: fix NULL dereference on root when tracing inode eviction - drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files - drm/amd/display: Apply e4479aecf658 to dml - [arm64] dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema warnings - [amd64] crypto: qat - fix duplicate restarting msg during AER error - [arm64] dts: add off-on-delay-us for usdhc2 regulator - netfilter: nft_set_pipapo: fix range overlap detection - netfilter: nft_synproxy: avoid possible data-race on update operation - [arm64,armhf] gpio: pca953x: Add support for level-triggered interrupts - [arm64,armhf] gpio: pca953x: handle short interrupt pulses on PCAL devices - netfilter: nf_tables: fix memory leak in nf_tables_newrule() - netfilter: nf_conncount: update last_gc only when GC has been performed - bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress - [arm64] net: mscc: ocelot: Fix crash when adding interface under a lag - inet: ping: Fix icmp out counting - net: sock: fix hardened usercopy panic in sock_recv_errqueue - netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates - net/mlx5e: Don't print error message due to invalid module - net: wwan: iosm: Fix memory leak in ipc_mux_deinit() - bnxt_en: Fix potential data corruption with HW GRO/LRO - vsock: Make accept()ed sockets use custom setsockopt() - btrfs: only enforce free space tree if v1 cache is required for bs < ps cases - [riscv64] pgtable: Cleanup useless VA_USER_XXX definitions - net: fix memory leak in skb_segment_list for GRO packets - idpf: keep the netdev when a reset fails - idpf: fix memory leak in idpf_vport_rel() - idpf: cap maximum Rx buffer size - HID: quirks: work around VID/PID conflict for appledisplay - net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset - net: usb: pegasus: fix memory leak in update_eth_regs_async() - arp: do not assume dev_hard_header() does not change skb->head - erofs: don't bother with s_stack_depth increasing for now - erofs: fix file-backed mounts no longer working on EROFS partitions - ALSA: ac97bus: Use guard() for mutex locks - ALSA: ac97: fix a double free in snd_ac97_controller_register() - btrfs: fix error handling of submit_uncompressed_range() - btrfs: subpage: dump the involved bitmap when ASSERT() failed - btrfs: add extra error messages for delalloc range related errors - btrfs: remove btrfs_fs_info::sectors_per_page - btrfs: truncate ordered extent when skipping writeback past i_size - btrfs: use variable for end offset in extent_writepage_io() - btrfs: fix beyond-EOF write handling - bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K - bpf: Make variables in bpf_prog_test_run_xdp less confusing - bpf: Support specifying linear xdp packet data size for BPF_PROG_TEST_RUN - bpf: Fix reference count leak in bpf_prog_test_run_xdp() - net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant - powercap: fix race condition in register_control_type() - powercap: fix sscanf() error return value handling - netfilter: nf_tables: avoid chain re-validation if possible - ata: libata-core: Disable LPM on ST2000DM008-2FR102 - drm/amd/display: Fix DP no audio issue - [arm64] spi: mt65xx: Use IRQF_ONESHOT with threaded IRQ - drm/amdkfd: Fix improper NULL termination of queue restore SMI event string - can: j1939: make j1939_session_activate() fail if device is no longer registered - ALSA: usb-audio: Update for native DSD support quirks - [amd64] ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 - ALSA: hda/realtek: enable woofer speakers on Medion NM14LNL - [arm64,armhf] ASoC: fsl_sai: Add missing registers to cache default - scsi: sg: Fix occasional bogus elapsed time that exceeds timeout - spi: cadence-quadspi: Prevent lost complete() call during indirect read - tpm2-sessions: Fix out of range indexing in name_size (CVE-2025-68792) - ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.67 - efi/cper: Fix cper_bits_to_str buffer handling and return value - Revert "gfs2: Fix use of bio_chain" - [amd64] x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 - xfrm: Fix inner mode lookup in tunnel mode GSO segmentation - xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set - pNFS: Fix a deadlock when returning a delegation during open() - NFS: Fix a deadlock involving nfs_release_folio() - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() - pnfs/blocklayout: Fix memory leak in bl_parse_scsi() - drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions - PM: EM: Fix incorrect description of the cost field in struct em_perf_state - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec - btrfs: send: check for inline extents in range_is_hole_in_parent() - net: bridge: annotate data-races around fdb->{updated,used} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() - net: update netdev_lock_{type,name} - macvlan: fix possible UAF in macvlan_forward_source() - ipv4: ip_gre: make ipgre_header() robust - net/mlx5e: Fix crash on profile change rollback failure - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - net/mlx5e: Restore destroying state bit after profile cleanup - btrfs: factor out init_space_info() from create_space_info() - btrfs: factor out check_removing_space_info() from btrfs_free_block_groups() - btrfs: introduce btrfs_space_info sub-group - btrfs: fix memory leaks in create_space_info() error paths - ALSA: hda/cirrus_scodec_test: Fix incorrect setup of gpiochip - net: hv_netvsc: reject RSS hash key programming without RX indirection table - ipv6: Fix use-after-free in inet6_addr_del(). - net/sched: sch_qfq: do not free existing class in qfq_change_class() - [amd64] ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type - drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 - mm: describe @flags parameter in memalloc_flags_save() - textsearch: describe @list member in ts_ops search - mm, kfence: describe @slab parameter in __kfence_obj_info() - [arm64] dmaengine: tegra-adma: Fix use-after-free - [arm64] phy: fsl-imx8mq-usb: Clear the PCS_TX_SWING_FULL field before using it - [arm64] phy: phy-snps-eusb2: refactor constructs names - phy: drop probe registration printks - [arm64] phy: qcom-qusb2: Fix NULL pointer dereference on early suspend - [armhf] phy: stm32-usphyc: Fix off by one in probe() - [armhf] dmaengine: omap-dma: fix dma_pool resource leak in error paths - [arm64] i2c: qcom-geni: make sure I2C hub controllers can't use SE DMA - HID: usbhid: paper over wrong bNumDescriptor field (Closes: #1122193) - bridge: mcast: Fix use-after-free during router port configuration (CVE-2025-38248) - [arm64] ASoC: codecs: wsa883x: fix unnecessary initialisation - drm/amd/display: mark static functions noinline_for_stack - io_uring: move local task_work in exit cancel loop - scsi: core: Fix error handler encryption support - ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer - null_blk: fix kmemleak by releasing references to fault configfs items - can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak - can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit. - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts - xfs: Fix the return value of xfs_rtcopy_summary() - lib/buildid: use __kernel_read() for sleepable context - [arm64] phy: rockchip: inno-usb2: fix communication disruption in gadget mode - [arm64,armhf] phy: ti: gmii-sel: fix regmap leak on probe failure - [arm64] phy: freescale: imx8m-pcie: assert phy reset during power on - [arm64] phy: rockchip: inno-usb2: fix disconnection in gadget mode - usb: dwc3: Check for USB4 IP_NAME - usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor - USB: OHCI/UHCI: Add soft dependencies on ehci_platform - USB: serial: option: add Telit LE910 MBIM composition - USB: serial: ftdi_sio: add support for PICAXE AXE027 cable - nvme-pci: disable secondary temp for Wodposit WPBSNM8 - [arm64] ASoC: codecs: wsa881x: fix unnecessary initialisation - ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref - hrtimer: Fix softirq base check in update_needs_ipi() - [amd64] EDAC/x38: Fix a resource leak in x38_probe1() - [amd64] EDAC/i3200: Fix a resource leak in i3200_probe1() - tcpm: allow looking for role_sw device in the main node - i2c: riic: Move suspend handling to NOIRQ phase - [amd64] x86/resctrl: Add missing resctrl initialization for Hygon - [amd64] x86/resctrl: Fix memory bandwidth counter width for Hygon - nvme: fix PCIe subsystem reset controller state transition - mm/zswap: fix error pointer free in zswap_cpu_comp_prepare() - mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure - drm/amd/display: Bump the HDMI clock to 340MHz - drm/amd: Clean up kfd node on surprise disconnect - drm/amdkfd: fix a memory leak in device_queue_manager_init() - drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare - [arm64,armhf] drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel - drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() - [arm64] dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() - [armhf] dmaengine: stm32: dmamux: fix device leak on route allocation - [armhf] dmaengine: stm32: dmamux: fix OF node leak on route allocation failure - [armhf] dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation - [armhf] dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation - [amd64] HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking - [amd64] HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type - xfs: set max_agbno to allow sparse alloc of last full inode chunk - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure - bpf: Reject narrower access to pointer ctx fields (CVE-2025-38591) - mm/fake-numa: allow later numa node hotplug - mm: numa,memblock: include for 'numa_nodes_parsed' - [arm64] phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path - [arm64] phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() - [arm64] dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure - mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection - mm/page_alloc: batch page freeing in decay_pcp_high - mm/page_alloc: prevent pcp corruption with SMP=n - mm/fake-numa: handle cases with no SRAT info https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.68 - posix-clock: Store file pointer in struct posix_clock_context - ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE. - dt-bindings: power: qcom,rpmpd: document the SM8750 RPMh Power Domains - dt-bindings: power: qcom,rpmpd: add Turbo L5 corner - dt-bindings: power: qcom-rpmpd: split RPMh domains definitions - dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO - [arm64] pmdomain: qcom: rpmhpd: Add MXC to SC8280XP - Drivers: hv: Always do Hyper-V panic notification in hv_kmsg_dump() - btrfs: fix missing fields in superblock backup with BLOCK_GROUP_TREE - ata: ahci: Do not read the per port area for unimplemented ports - ata: libata-sata: Improve link_power_management_supported sysfs attribute - ata: libata: Add cpr_log to ata_dev_print_features() early return - ata: libata-core: Introduce ata_dev_config_lpm() - ata: libata: Call ata_dev_config_lpm() for ATAPI devices - ata: libata: Print features also for ATAPI devices - ice: initialize ring_stats->syncp - ice: Avoid detrimental cleanup for bond during interface stop - ice: Fix incorrect timeout ice_release_res() - igc: Restore default Qbv schedule when changing channels - igc: fix race condition in TX timestamp read for register 0 - vsock/virtio: Coalesce only linear skb - net: usb: dm9601: remove broken SR9700 support - bonding: limit BOND_MODE_8023AD to Ethernet devices - l2tp: Fix memleak in l2tp_udp_encap_recv(). - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT - [amd64,arm64] amd-xgbe: avoid misleading per-packet error log - gue: Fix skb memleak with inner IP protocol 0. - fou: Don't allow 0 for FOU_ATTR_IPPROTO. - veth: fix data race in veth_get_ethtool_stats - l2tp: avoid one data-race in l2tp_tunnel_del_work() - ipvlan: Make the addrs_lock be per port - [arm64] octeontx2: cn10k: fix RX flowid TCAM mask handling - net/sched: Enforce that teql can only be used as root qdisc - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - wifi: mac80211: don't perform DA check on S1G beacon - serial: 8250_pci: Fix broken RS485 for F81504/508/512 - w1: therm: Fix off-by-one buffer overflow in alarms_store - w1: fix redundant counter decrement in w1_attach_slave_device() - Revert "nfc/nci: Add the inconsistency check between the input data length and count" - Input: i8042 - add quirks for MECHREVO Wujie 15X Pro - Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA - scsi: storvsc: Process unsupported MODE_SENSE_10 - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() - [arm64] dts: rockchip: remove dangerous max-link-speed from helios64 - [arm64] dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro - [amd64] x86/kfence: avoid writing L1TF-vulnerable PTEs - [amd64] comedi: Fix getting range information for subdevices 16 to 255 - [amd64] platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names - [amd64] platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro - mm/rmap: fix two comments related to huge_pmd_unshare() - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop - iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection - interconnect: debugfs: initialize src_node and dst_node to empty strings - regmap: Fix race condition in hwspinlock irqsave routine - [riscv64] clocksource: Fix stimecmp update hazard on RV32 - [amd64] platform/x86/amd: Fix memory leak in wbrf_record() - scsi: core: Wake up the error handler when final completions race against each other - scsi: qla2xxx: Sanitize payload size to prevent member overflow - ALSA: usb: Increase volume range that triggers a warning - ice: Fix persistent failure in ice_get_rxfh - [arm64] net: hns3: fix data race in hns3_fetch_stats - be2net: fix data race in be_get_new_eqd - [arm64] net: hns3: fix wrong GENMASK() for HCLGE_FD_AD_COUNTER_NUM_M - [arm64] net: hns3: fix the HCLGE_FD_AD_NXT_KEY error setting issue - mISDN: annotate data-race around dev->work - ipv6: annotate data-race in ndisc_router_discovery() - usbnet: limit max_mtu based on device's hard_mtu - clocksource: Reduce watchdog readout delay limit to prevent false positives - sched/fair: Fix pelt clock sync when entering idle - drm/amd/pm: Don't clear SI SMC table when setting power limit - drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) - drm/nouveau: add missing DCB connector types - drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list - bonding: provide a net pointer to __skb_flow_dissect() - [arm64,armhf] net: dsa: fix off-by-one in maximum bridge ID determination - [arm64] octeontx2-af: Fix error handling - net: openvswitch: fix data race in ovs_vport_get_upcall_stats - vsock/virtio: fix potential underflow in virtio_transport_get_credit() - vsock/virtio: cap TX credit to local buffer size - net/sched: act_ife: avoid possible NULL deref - dpll: Prevent duplicate registrations - [amd64] x86: make page fault handling disable interrupts properly - tpm: Compare HMAC values in constant time - keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal - leds: led-class: Only Add LED to leds_list when it is fully ready - of: fix reference count leak in of_alias_scan() - of: platform: Use default match table for /firmware - iio: accel: iis328dq: fix gain values - iio: adc: ad9467: fix ad9434 vref mask - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver - iio: adc: pac1934: Fix clamped value in pac1934_reg_snapshot - iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Closes: #1121535) - ALSA: scarlett2: Fix buffer overflow in config retrieval - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() - mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function - mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode - drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) - wifi: ath10k: fix dma_free_coherent() pointer - wifi: ath12k: fix dma_free_coherent() pointer - wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() - wifi: rsi: Fix memory corruption due to not set vif driver data size - [arm64] fpsimd: signal: Allocate SSVE storage when restoring ZA - [arm64] Set __nocfi on swsusp_arch_resume() - slimbus: core: fix runtime PM imbalance on report present - slimbus: core: fix device reference leak on report present - tracing: Fix crash on synthetic stacktrace field usage - [amd64] intel_th: fix device leak on output open() - mei: trace: treat reg parameter as string - [s390x] ap: Fix wrong APQN fill calculation - netrom: fix double-free in nr_route_frame() - [amd64] platform/x86: hp-bioscfg: Fix automatic module loading - [arm64] pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu - [amd64] perf/x86/intel: Do not enable BTS for guests - [arm64,armhf] irqchip/gic-v3-its: Avoid truncating memory addresses - net: sfp: add potron quirk to the H-COM SPP425H-GAB4 SFP+ Stick - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak - drm/amdgpu: remove frame cntl for gfx v12 - gpio: cdev: Correct return code on memory allocation failure - migrate: correct lock ordering for hugetlb file folios - [arm64] dmaengine: ti: k3-udma: Enable second resource range for BCDMA and PKTDMA - can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak - bpf: Do not let BPF test infra emit invalid GSO types to stack (CVE-2025-68725) - [arm64] dts: rockchip: remove redundant max-link-speed from nanopi-r4s - iio: core: add missing mutex_destroy in iio_dev_release() - iio: core: Replace lockdep_set_class() + mutex_init() by combined call - iio: core: add separate lockdep class for info_exist_lock - [armhf] iio: adc: exynos_adc: fix OF populate on driver rebind - exfat: fix refcount leak in exfat_find (CVE-2025-68351) - sched_ext: Fix possible deadlock in the deferred_irq_workfn() (CVE-2025-68333) - fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365) - [amd64] accel/ivpu: Fix race condition when unbinding BOs (CVE-2025-68749) - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (CVE-2025-68358) - wifi: ath11k: fix RCU stall while reaping monitor destination ring (CVE-2024-58097) - vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() - vsock/virtio: Rename virtio_vsock_alloc_skb() - vsock/virtio: Move SKB allocation lower-bound check to callers - vsock/virtio: Rename virtio_vsock_skb_rx_put() - vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers - vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers - net: Introduce skb_copy_datagram_from_iter_full() - vsock/virtio: Fix message iterator handling on transmit path https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.69 - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work - Bluetooth: MGMT: Fix memory leak in set_ssp_complete - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() - can: gs_usb: gs_usb_receive_bulk_callback(): fix error message - bonding: annotate data-races around slave->last_rx - [arm64,armhf] net: mvpp2: cls: Fix memory leak in mvpp2_ethtool_cls_rule_ins() - ipv6: use the right ifindex when replying to icmpv6 from localhost - net: wwan: t7xx: fix potential skb->frags overflow in RX path - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues - ice: stop counting UDP csum mismatch as rx_errors - net/mlx5e: TC, delete flows only for existing peers - nfc: nci: Fix race between rfkill and nci_unregister_device(). - net: bridge: fix static key check - net: phy: micrel: fix clk warning when removing the driver - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect - net/mlx5: Initialize events outside devlink lock - net/mlx5: Fix vhca_id access call trace use before alloc - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload - scsi: firewire: sbp-target: Fix overflow in sbp_make_tpg() - [amd64] ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion - gpiolib: acpi: use BIT_ULL() for u64 mask in address space handler - gpio: virtuser: fix UAF in configfs release path - bcache: fix improper use of bi_end_io - bcache: use bio cloning for detached device requests - bcache: fix I/O accounting leak in detached_dev_do_request - dma/pool: distinguish between missing and exhausted atomic pools - sched/deadline: Document dl_server - sched/deadline: Fix 'stuck' dl_server - [arm64,armhf] pinctrl: meson: mark the GPIO controller as sleeping - [riscv64] compat: fix COMPAT_UTS_MACHINE definition - scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() - [amd64] ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO - [arm64,armhf] gpio: pca953x: mask interrupts in irq shutdown - scsi: qla2xxx: edif: Fix dma_free_coherent() size - efivarfs: fix error propagation in efivar_entry_get() - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Closes: #1122521) - gpio: rockchip: Stop calling pinctrl for set_direction - mptcp: only reset subflow errors when propagated - flex_proportions: make fprop_new_period() hardirq safe - mm/memory-failure: fix missing ->mf_stats count in hugetlb poison - mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn - mm/shmem, swap: fix race of truncate and swap entry split - net: fix segmentation of forwarding fraglist GRO - [arm64] drm/msm/a6xx: fix bogus hwcg register updates - drm/amdgpu/soc21: fix xclk for APUs - drm/amdgpu/gfx10: fix wptr reset in KGQ init - drm/amdgpu/gfx11: fix wptr reset in KGQ init - drm/amdgpu/gfx12: fix wptr reset in KGQ init - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove - drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() - gpiolib: acpi: Fix potential out-of-boundary left shift - cgroup: Fix kernfs_node UAF in css_free_rwork_fn - rxrpc: Fix data-race warning and potential load/store tearing - ksmbd: smbd: fix dma_unmap_sg() nents (CVE-2026-23093) - mm/kfence: randomize the freelist on initialization - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode (CVE-2024-58096) - Revert "drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit)" - btrfs: prevent use-after-free on folio private data in btrfs_subpage_clear_uptodate() - net/sched: act_ife: convert comma to semicolon - [arm64] pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins - mptcp: avoid dup SUB_CLOSED events after disconnect - perf: Simplify get_perf_callchain() user logic - perf: sched: Fix perf crash with new is_user_task() helper - writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 - drm/amdgpu/gfx11: adjust KGQ reset sequence - [arm64] pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver - net: mana: Change the function signature of mana_get_primary_netdev_rcu - RDMA/mana_ib: Handle net event for pointing to the current netdev [ Macpaul Lin ] * udeb: Add USB TYPE-C and Mux modules in usb-modules (Closes: #1109090) [ Salvatore Bonaccorso ] * fs/nfsd: Enable NFSD_SCSILAYOUT (NFSv4.1 server support for pNFS SCSI layouts) * [rt] Update to 6.12.66-rt15 -- Salvatore Bonaccorso Sun, 08 Feb 2026 08:58:22 +0100 linux (6.12.63-1~bpo12+1) bookworm-backports; urgency=medium * Rebuild for bookworm-backports -- Ben Hutchings Fri, 02 Jan 2026 17:55:03 +0100 linux (6.12.63-1) trixie; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.58 - NFSD: Fix crash in nfsd4_read_release() - net: usb: asix_devices: Check return value of usbnet_get_endpoints - fbcon: Set fb_display[i]->mode to NULL when the mode is released - fbdev: atyfb: Check if pll_ops->init_pll failed - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() - ACPI: button: Call input_free_device() on failing input device registration - virtio-net: drop the multi-buffer XDP packet in zerocopy - fbdev: bitblit: bound-check glyph index in bit_putcs* - Bluetooth: rfcomm: fix modem control handling - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode - mptcp: drop bogus optimization in __mptcp_check_push() - mptcp: restore window probe - [arm64] ASoC: qdsp6: q6asm: do not sleep while atomic - [s390x] pci: Restore IRQ unconditionally for the zPCI device - smb: client: fix potential cfid UAF in smb2_query_info_compound - [amd64] x86/fpu: Ensure XFD state on signal delivery - wifi: ath10k: Fix memory leak on unsupported WMI command - wifi: ath11k: Add missing platform IDs for quirk table - wifi: ath12k: free skb during idr cleanup callback - wifi: ath11k: add support for MU EDCA - wifi: ath11k: avoid bit operation on key flags - [arm64] drm/msm/a6xx: Fix GMU firmware parser - ALSA: usb-audio: fix control pipe direction - wifi: mac80211: don't mark keys for inactive links as uploaded - wifi: mac80211: fix key tailroom accounting leak - bpf: Sync pending IRQ work before freeing ring buffer - scsi: ufs: core: Initialize value of an attribute returned by uic cmd - bpf: Find eligible subprogs for private stack support - bpf, x86: Avoid repeated usage of bpf_prog->aux->stack_depth - bpf: Do not audit capability check in do_jit() - [amd64] ASoC: Intel: avs: Unprepare a stream when XRUN occurs - [amd64] ASoC: Intel: avs: Disable periods-elapsed work when closing PCM - [arm64,armhf] ASoC: fsl_sai: fix bit order for DSD format - libbpf: Fix powerpc's stack register definition in bpf_tracing.h - usbnet: Prevents free active kevent - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once - Bluetooth: ISO: Update hci_conn_hash_lookup_big for Broadcast slave - Bluetooth: ISO: Fix BIS connection dst_type handling - Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset - Bluetooth: HCI: Fix tracking of advertisement set/instance 0x00 - Bluetooth: ISO: Fix another instance of dst_type handling - Bluetooth: hci_core: Fix tracking of periodic advertisement - [arm64,armhf] drm/etnaviv: fix flush sequence logic - [arm64] net: hns3: return error code when function fails - sfc: fix potential memory leak in efx_mae_process_mport() - dpll: spec: add missing module-name and clock-id to pin-get reply - [arm64,armhf] ASoC: fsl_sai: Fix sync error in consumer mode - drm/radeon: Do not kfree() devres managed rdev - drm/radeon: Remove calls to drm_put_dev() - drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji - drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland - ACPI: fan: Use ACPI handle when retrieving _FST - block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL - block: make REQ_OP_ZONE_OPEN a write operation - regmap: slimbus: fix bus_context pointer in regmap init calls - [s390x] mm: Fix memory leak in add_marker() when kvrealloc() fails - drm/xe: Do not wake device during a GT reset - drm/sysfb: Do not dereference NULL pointer in plane reset - drm/sched: avoid killing parent entity on child SIGKILL - drm/nouveau: Fix race in nouveau_sched_fini() - [arm64] drm/mediatek: Fix device use-after-free on unbind - drm/amd: Check that VPE has reached DPM0 in idle handler - drm/amd/display: Fix incorrect return of vblank enable on unconfigured crtc (Closes: #1000966) - ACPI: fan: Add fan speed reporting for fans with only _FST - ACPI: fan: Use platform device for devres-related actions - sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU - cpuidle: governors: menu: Rearrange main loop in menu_select() - cpuidle: governors: menu: Select polling state in some more cases - [amd64] mfd: kempld: Switch back to earlier ->init() behavior - [amd64] x86/CPU/AMD: Add RDSEED fix for Zen5 - usb: gadget: f_fs: Fix epfile null pointer access after ep enable. - drm/sched: Optimise drm_sched_entity_push_job - drm/sched: Re-group and rename the entity run-queue lock - drm/sched: Fix race in drm_sched_entity_select_rq() - [s390x] pci: Avoid deadlock between PCI error recovery and mlx5 crdump - [s390x] Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP - [armhf] soc: aspeed: socinfo: Add AST27xx silicon IDs - [arm64] firmware: qcom: scm: preserve assign_mem() error return value - [arm64] soc: qcom: smem: Fix endian-unaware access of num_entries - [arm64] soc: ti: pruss: don't use %pK through printk - bpf: Don't use %pK through printk - pinctrl: single: fix bias pull up/down handling in pin_config_set - [arm64] mmc: host: renesas_sdhi: Fix the actual clock - memstick: Add timeout to prevent indefinite waiting - [arm64,armhf] cpufreq: ti: Add support for AM62D2 - bpf: Use tnums for JEQ/JNE is_branch_taken logic - firewire: ohci: move self_id_complete tracepoint after validating register - [riscv64] irqchip/sifive-plic: Respect mask state when setting affinity - io_uring/zctx: check chained notif contexts - ACPI: sysfs: Use ACPI_FREE() for freeing an ACPI object - ACPI: video: force native for Lenovo 82K8 - libbpf: Fix USDT SIB argument handling causing unrecognized register error - cpufreq/longhaul: handle NULL policy in longhaul_exit - [arm64,armhf] irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment - ACPI: PRM: Skip handlers with NULL handler_address or NULL VA - ACPI: resource: Skip IRQ override on ASUS Vivobook Pro N6506CU - ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids[] - thermal: gov_step_wise: Allow cooling level to be reduced earlier - power: supply: qcom_battmgr: add OOI chemistry - [amd64] hwmon: (k10temp) Add thermal support for AMD Family 1Ah-based models - [amd64] hwmon: (k10temp) Add device ID for Strix Halo - power: supply: sbs-charger: Support multiple devices - cpufreq: ondemand: Update the efficient idle check for Intel extended Families - [arm64,armhf] soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups - [arm64] firmware: qcom: tzmem: disable sc7180 platform - [arm64] mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card - pwm: pca9685: Use bulk write to atomicially update registers - ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() - [amd64,arm64] tee: allow a driver to allocate a tee_device without a pool - nvmet-fc: avoid scheduling association deletion twice - nvme-fc: use lock accessing port_state and rport state - bpf: Do not limit bpf_cgroup_from_id to current's namespace - i3c: mipi-i3c-hci-pci: Add support for Intel Wildcat Lake-U I3C - video: backlight: lp855x_bl: Set correct EPROM start for LP8556 - tools/cpupower: fix error return value in cpupower_write_sysfs() - power: supply: qcom_battmgr: handle charging state change notifications - bpftool: Fix -Wuninitialized-const-pointer warnings with clang >= 21 - cpuidle: Fail cpuidle device registration if there is one already - futex: Don't leak robust_list pointer on exec race - ACPI: SPCR: Support Precise Baud Rate field - blk-cgroup: fix possible deadlock while configuring policy - [riscv64] bpf: Fix uninitialized symbol 'retval_off' - bpf: Clear pfmemalloc flag when freeing all fragments - nvme: Use non zero KATO for persistent discovery connections - uprobe: Do not emulate/sstep original instruction when ip is changed - [amd64] hwmon: (asus-ec-sensors) increase timeout for locking ACPI mutex - [amd64] hwmon: (dell-smm) Remove Dell Precision 490 custom config data - tools/cpupower: Fix incorrect size in cpuidle_state_disable() - tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage - tools/power x86_energy_perf_policy: Enhance HWP enable - tools/power x86_energy_perf_policy: Prefer driver HWP limits - [armhf] mfd: stmpe: Remove IRQ domain upon removal - [armhf] mfd: stmpe-i2c: Add missing MODULE_LICENSE - [riscv64] mfd: da9063: Split chip variant reading in two bus transactions - mfd: core: Increment of_node's refcount before linking it to the platform device - [amd64] mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs - drm/amd/display: fix condition for setting timing_adjust_pending - drm/amd/display: ensure committing streams is seamless - drm/amdgpu: add range check for RAS bad page address - drm/amdgpu: Check vcn sram load return value - drm/amd/display: Move setup_stream_attribute - drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration - drm/xe/guc: Add more GuC load error status codes - drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. - drm/amdgpu: Avoid rma causes GPU duplicate reset - drm/amd/amdgpu: Release xcp drm memory after unplug - drm/amdgpu: Skip poison aca bank from UE channel - drm/amd/display: add more cyan skillfish devices - drm/amd/display: update dpp/disp clock from smu clock table - drm/amd/pm: Use cached metrics data on aldebaran - drm/amd/pm: Use cached metrics data on arcturus - drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff - drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() - [arm64] ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks - drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off - drm/amd/display: Wait until OTG enable state is cleared - PCI: Disable MSI on RDC PCI to PCIe bridges - wifi: rtw89: print just once for unknown C2H events - wifi: rtw88: sdio: use indirect IO for device registers before power-on - drm/amdkfd: return -ENOTTY for unsupported IOCTLs - media: pci: ivtv: Don't create fake v4l2_fh - [arm64] drm/tidss: Use the crtc_* timings when programming the HW - [arm64] drm/tidss: Set crtc modesetting parameters with adjusted mode - PCI/ERR: Update device error_state already after reset - [amd64] x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall - net: stmmac: Check stmmac_hw_setup() in stmmac_resume() - ice: Don't use %pK through printk or tracepoints - thunderbolt: Use is_pciehp instead of is_hotplug_bridge - tty: serial: ip22zilog: Use platform device for probing - [powerpc*] eeh: Use result of error_detected() in uevent - [s390x] pci: Use pci_uevent_ers() in PCI recovery - bridge: Redirect to backup port when port is administratively down - net: ipv6: fix field-spanning memcpy warning in AH output - media: imon: make send_packet() more robust - [arm64] drm/panthor: Serialize GPU cache flush operations - HID: pidff: Use direction fix only for conditional effects - HID: pidff: PERMISSIVE_CONTROL quirk autodetection - [arm64,armhf] drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts - drm/amdgpu: fix nullptr err of vm_handle_moved - drm/amdkfd: Handle lack of READ permissions in SVM mapping - iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register - iio: adc: imx93_adc: load calibrated values even calibration failed - usb: gadget: f_ncm: Fix MAC assignment NCM ethernet - wifi: rtw89: wow: remove notify during WoWLAN net-detect - wifi: rtw89: fix BSSID comparison for non-transmitted BSSID - dm error: mark as DM_TARGET_PASSES_INTEGRITY - char: misc: Make misc_register() reentry for miscdevice who wants dynamic minor - char: misc: Does not request module for miscdevice with dynamic minor - net: When removing nexthops, don't call synchronize_net if it is not necessary - net: stmmac: Correctly handle Rx checksum offload errors - net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. - f2fs: fix to detect potential corrupted nid in free_nid_list - PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call - bnxt_en: Add Hyper-V VF ID - tty: serial: Modify the use of dev_err_probe() - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units - [amd64,arm64] idpf: do not linearize big TSO packets - rds: Fix endianness annotation for RDS_MPATH_HASH - media: ipu6: isys: Set embedded data type correctly for metadata formats - rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table - net: ipv4: allow directed broadcast routes to use dst hint - scsi: mpi3mr: Fix I/O failures during controller reset - scsi: mpi3mr: Fix controller init failure on fault during queue creation - scsi: pm80xx: Fix race condition caused by static variables - remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device - fuse: zero initialize inode private data - drm/amdgpu: Correct the counts of nr_banks and nr_errors - drm/amdkfd: fix vram allocation failure for a special case - drm/amd/display: Support HW cursor 180 rot for any number of pipe splits - drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption - [amd64] platform/x86/intel-uncore-freq: Fix warning in partitioned system - media: fix uninitialized symbol warnings - media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS - [amd64] ASoC: SOF: ipc4-pcm: Add fixup for channels - drm/amd/display: Increase minimum clock for TMDS 420 with pipe splitting - drm/amd/display: incorrect conditions for failing dto calculations - drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest - drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2) - inet_diag: annotate data-races in inet_diag_bc_sk() - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() - [amd64] crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof() - scsi: pm8001: Use int instead of u32 to store error codes - [arm64] scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on suspend - ptp: Limit time setting of PTP clocks - dmaengine: sh: setup_xref error handling - [arm64,armhf] dmaengine: mv_xor: match alloc_wc and free_wc - [arm64] drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL - [arm64] drm/msm/dsi/phy_7nm: Fix missing initial VCO rate - drm/amdgpu: Allow kfd CRIU with no buffer objects - drm/xe/guc: Increase GuC crash dump buffer size - ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled - [arm64] drm/panthor: check bo offset alignment in vm bind - drm: panel-backlight-quirks: Make EDID match optional - net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms - media: adv7180: Add missing lock in suspend callback - media: adv7180: Do not write format to device in set_fmt - media: adv7180: Only validate format in querystd - [arm64,armhf] media: verisilicon: Explicitly disable selection api ioctls for decoders - wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in lower bands - ALSA: usb-audio: apply quirk for MOONDROP Quark2 - [arm64,armhf] PCI: imx6: Enable the Vaux supply if available - drm/xe/guc: Set upper limit of H2G retries over CTB - net: call cond_resched() less often in __release_sock() - smsc911x: add second read of EEPROM mac when possible corruption seen - [amd64] iommu/amd: Skip enabling command/event buffers for kdump - [amd64] crypto: ccp: Skip SEV and SNP INIT for kdump boot - drm/amd: add more cyan skillfish PCI ids - drm/amdgpu: don't enable SMU on cyan skillfish - drm/amdgpu: add support for cyan skillfish gpu_info - drm/amd/display: Fix pbn_div Calculation Error - [arm64] net: dsa: felix: support phy-mode = "10g-qxgmii" - usb: gadget: f_hid: Fix zero length packet transfer - usb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget - tty/vt: Add missing return value for VT_RESIZE in vt_ioctl() - [arm64] drm/msm: make sure to not queue up recovery more than once - char: Use list_del_init() in misc_deregister() to reinitialize list pointer - PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs - wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list - [amd64] media: ov08x40: Fix the horizontal flip control - media: i2c: og01a1b: Specify monochrome media bus format instead of Bayer - f2fs: fix wrong layout information on 16KB page - net: phy: marvell: Fix 88e1510 downshift counter errata - ntfs3: pretend $Extend records as regular files - wifi: mac80211: Fix HE capabilities element check - [arm64] phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf register 0 - [arm64] drm/msm/registers: Generate _HI/LO builders for reg64 - net: sh_eth: Disable WoL if system can not suspend - netfilter: nf_reject: don't reply to icmp error messages - [amd64] x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT - net: devmem: expose tcp_recvmsg_locked errors - udp_tunnel: use netdev_warn() instead of netdev_WARN() - HID: asus: add Z13 folio to generic group for multitouch to work - watchdog: s3c2410_wdt: Fix max_timeout being calculated larger - [arm64] crypto: sun8i-ce - remove channel timeout field - PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify() - [amd64] crypto: ccp - Fix incorrect payload size calculation in psp_poulate_hsti() - [arm64,armhf] crypto: caam - double the entropy delay interval for retry - net/cls_cgroup: Fix task_get_classid() during qdisc run - wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922 device - wifi: mt76: mt7996: Temporarily disable EPCS - wifi: mt76: mt76_eeprom_override to int - ALSA: serial-generic: remove shared static buffer - wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error - drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl - drm/amd/display: Set up pixel encoding for YCBCR422 - drm/amd/display: fix dml ms order of operations - drm/amd: Avoid evicting resources at S5 - drm/amd/display: Fix DVI-D/HDMI adapters - drm/amd/display: Disable VRR on DCE 6 - drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg with DC_FP_START - page_pool: always add GFP_NOWARN for ATOMIC allocations - ethernet: Extend device_get_mac_address() to use NVMEM - HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 - drm/xe/guc: Return an error code if the GuC load fails - drm/amdgpu: reject gang submissions under SRIOV - scsi: ufs: core: Disable timestamp functionality if not supported - scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail - scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - scsi: lpfc: Define size of debugfs entry for xri rebalancing - scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology - allow finish_no_open(file, ERR_PTR(-E...)) - usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs - usb: xhci: plat: Facilitate using autosuspend for xhci plat devices - f2fs: fix infinite loop in __insert_extent_tree() - wifi: rtw89: obtain RX path from ppdu status IE00 - wifi: rtw89: renew a completion for each H2C command waiting C2H event - usb: xhci-pci: add support for hosts with zero USB3 ports - ipv6: np->rxpmtu race annotation - RDMA/irdma: Update Kconfig - IB/ipoib: Ignore L3 master device - jfs: Verify inode mode when loading from disk - jfs: fix uninitialized waitqueue in transaction manager - drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() - [arm64] ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() - net: phy: clear link parameters on admin link down - bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state - [amd64] iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot() - wifi: ath10k: Fix connection after GTK rekeying - wifi: mac80211: Track NAN interface start/stop - net: intel: fm10k: Fix parameter idx set but not used - r8169: set EEE speed down ratio to 1 - vfio: return -ENOTTY for unsupported device feature - PCI/PM: Skip resuming to D0 if device is disconnected - remoteproc: qcom: q6v5: Avoid handling handover twice - wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256 - [armhf] net: dsa: microchip: Set SPI as bus interface during reset for KSZ8463 - drm/amd/display: Add AVI infoframe copy in copy_stream_update_to_stream - drm/amd/display: Init dispclk from bootup clock for DCN314 - drm/amd/display: Fix for test crash due to power gating - drm/amd/display: change dc stream color settings only in atomic commit - NFSv4: handle ERR_GRACE on delegation recalls - NFSv4.1: fix mount hang after CREATE_SESSION failure - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing - net: bridge: Install FDB for bridge MAC on VLAN 0 - scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill() - [amd64] accel/habanalabs/gaudi2: fix BMON disable configuration - scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate - [amd64] accel/habanalabs: return ENOMEM if less than requested pages were pinned - [amd64] accel/habanalabs/gaudi2: read preboot status after recovering from dirty state - [amd64] accel/habanalabs: support mapping cb with vmalloc-backed coherent memory - fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock - ext4: increase IO priority of fastcommit - amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw - [armhf] ASoC: stm32: sai: manage context in set_sysclk callback - [armhf] ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 - ACPI: scan: Update honor list for RPMI System MSI - vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices - net/mlx5e: Don't query FEC statistics when FEC is disabled - net: macb: avoid dealing with endianness in macb_set_hwaddr() - Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames - Bluetooth: SCO: Fix UAF on sco_conn_free - Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922 - Bluetooth: bcsp: receive data only if registered - ALSA: usb-audio: add mono main switch to Presonus S1824c - net: stmmac: est: Drop frames causing HLBS error - exfat: limit log print for IO error - exfat: validate cluster allocation bits of the allocation bitmap - 6pack: drop redundant locking and refcounting - page_pool: Clamp pool size to max 16K pages - orangefs: fix xattr related buffer overflow... - ftrace: Fix softlockup in ftrace_module_enable - ksmbd: use sock_create_kern interface to create kernel socket - smb: client: transport: avoid reconnects triggered by pending task work - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - usb: xhci-pci: Fix USB2-only root hub registration - char: misc: restrict the dynamic range to exclude reserved minors - drm/amd/display: Add fallback path for YCBCR422 - ACPICA: Update dsmethod.c to get rid of unused variable warning - RDMA/irdma: Fix SD index calculation - RDMA/irdma: Remove unused struct irdma_cq fields - RDMA/irdma: Set irdma_cq cq_num field during CQ create - [arm64] RDMA/hns: Fix recv CQ and QP cache affinity - [arm64] RDMA/hns: Fix the modification of max_send_sge - [arm64] RDMA/hns: Fix wrong WQE data when QP wraps around - btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation - btrfs: mark dirty extent range for out of bound prealloc extents - fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink - clk: sunxi-ng: sun6i-rtc: Add A523 specifics - [arm64] rtc: pcf2127: clear minute/second interrupt - 9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN - [armhf] clk: ti: am33xx: keep WKUP_DEBUGSS_CLKCTRL enabled - [arm64] clk: scmi: Add duty cycle ops only when duty cycle is supported - 9p: fix /sys/fs/9p/caches overwriting itself - 9p: sysfs_init: don't hardcode error to ENOMEM - scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS - ACPI: property: Return present device nodes only on fwnode interface - tools bitmap: Add missing asm-generic/bitsperlong.h include - tools: lib: thermal: don't preserve owner in install - tools: lib: thermal: use pkg-config to locate libnl3 - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds - [arm64] rtc: pcf2127: fix watchdog interrupt mask on pcf2131 - net: wwan: t7xx: add support for HP DRMR-H01 - kbuild: uapi: Strip comments before size type check - [arm64,armhf] ASoC: meson: aiu-encoder-i2s: fix bit clock polarity - drm/amdkfd: Fix mmap write lock not release - ceph: add checking of wait_for_completion_killable() return value - ceph: fix potential race condition in ceph_ioctl_lazyio() - ceph: refactor wake_up_bit() pattern of calling - ceph: fix multifs mds auth caps issue - [amd64] x86: use cmov for user address masking - [amd64] x86/runtime-const: Add the RUNTIME_CONST_PTR assembly macro - [amd64] x86: uaccess: don't use runtime-const rewriting in modules - ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again - btrfs: ensure no dirty metadata is written back for an fs with errors - media: uvcvideo: Use heuristic to find stream entity - media: videobuf2: forbid remove_bufs when legacy fileio is active - [arm64] drm/mediatek: Disable AFBC support on Mediatek DRM driver - Revert "wifi: ath10k: avoid unnecessary wait for service ready message" (Closes: #1120680) - ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up - [riscv64] ptdump: use seq_puts() in pt_dump_seq_puts() macro - Bluetooth: hci_event: validate skb length for unknown CC opcode - Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2() - [armhf] net: dsa: tag_brcm: legacy: reorganize functions - [armhf] net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx - net: vlan: sync VLAN features with lower device - gpio: swnode: don't use the swnode's name as the key for GPIO lookup - gpiolib: fix invalid pointer access in debugfs - [armhf] net: dsa: b53: fix resetting speed and pause on forced link - [armhf] net: dsa: b53: fix bcm63xx RGMII port link adjustment - [armhf] net: dsa: b53: fix enabling ip multicast - [armhf] net: dsa: b53: stop reading ARL entries if search is done - sctp: Hold RCU read lock while iterating over address list - sctp: Prevent TOCTOU out-of-bounds write - sctp: Hold sock lock while iterating over address list - net: ionic: add dma_wmb() before ringing TX doorbell - net: ionic: map SKB after pseudo-header checksum prep - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup - bnxt_en: Fix a possible memory leak in bnxt_ptp_init - bnxt_en: Add mem_valid bit to struct bnxt_ctx_mem_type - bnxt_en: Refactor bnxt_free_ctx_mem() - bnxt_en: Add a 'force' parameter to bnxt_free_ctx_mem() - wifi: mac80211_hwsim: Limit destroy_on_close radio removal to netgroup - net/mlx5e: Fix return value in case of module EEPROM read error - [arm64] net: ti: icssg-prueth: Fix fdb hash size configuration - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - [armhf] net: dsa: microchip: Fix reserved multicast address table programming - net: bridge: fix use-after-free due to MST port state bypass - net: bridge: fix MST static key usage - tracing: Fix memory leaks in create_field_var() - drm/amd/display: Enable mst when it's detected but yet to be initialized - drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() - [arm64] rtc: rx8025: fix incorrect register reference - [amd64] x86/microcode/AMD: Add more known models to entry sign checking - smb: client: validate change notify buffer before copy - smb: client: fix potential UAF in smb2_close_cached_fid() - drm/amdgpu/smu: Handle S0ix for vangogh - drm/amd/display: Fix NULL deref in debugfs odm_combine_segments - virtio-net: fix received length check in big packets - lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC - scsi: ufs: ufs-pci: Fix S0ix/S3 for Intel controllers - scsi: ufs: ufs-pci: Set UFSHCD_QUIRK_PERFORM_LINK_STARTUP_ONCE for Intel ADL - scsi: ufs: core: Add a quirk to suppress link_startup_again - drm/amd/display: update color on atomic commit time - ACPI: SPCR: Check for table version when using precise baudrate - drm/amdgpu: Fix unintended error log in VCN5_0_0 - drm/amdgpu: Fix function header names in amdgpu_connectors.c - drm/amd/display: Fix black screen with HDMI outputs https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.59 - [arm64] drm/mediatek: Add pm_runtime support for GCE power control - [amd64] drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD - [amd64] drm/i915: Fix conversion between clock ticks and nanoseconds - smb: client: fix refcount leak in smb2_set_path_attr - drm/amd: Fix suspend failure with secure display TA - drm/xe/guc: Synchronize Dead CT worker with unbind - drm/xe: Move declarations under conditional branch - drm/xe: Do clean shutdown also when using flr - [arm64] kprobes: check the return value of set_memory_rox() - [riscv64] clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors - [riscv64] acpi: avoid errors caused by probing DT devices when ACPI is used - drm/amdgpu: remove two invalid BUG_ON()s - drm/amd/pm: Disable MCLK switching on SI at high pixel clocks - drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM - drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices - NFS4: Fix state renewals missing after boot - NFS4: Apply delay_retrans to async operations - HID: quirks: avoid Cooler Master MM712 dongle wakeup bug - HID: nintendo: Wait longer for initial probe - NFS: check if suid/sgid was cleared after a write as needed - HID: quirks: Add ALWAYS_POLL quirk for VRS R295 steering wheel - exfat: fix improper check of dentry.stream.valid_size - smb/server: fix possible memory leak in smb2_read() - smb/server: fix possible refcount leak in smb2_sess_setup() - HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down - wifi: ath11k: zero init info->status in wmi_process_mgmt_tx_comp() - erofs: avoid infinite loop due to incomplete zstd-compressed data - [arm64,armhf] net: fec: correct rx_bytes statistic for the case SHIFT16 is set - net: phy: micrel: Introduce lanphy_modify_page_reg - net: phy: micrel: Replace hardcoded pages with defines - net: phy: micrel: lan8814 fix reset of the QSGMII interface - NFSD: Skip close replay processing if XDR encoding fails - Bluetooth: MGMT: cancel mesh send timer when hdev removed - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF - Bluetooth: 6lowpan: reset link-local header on ipv6 recv path - Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion - Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto - net/smc: fix mismatch between CLC header and proposal - net/handshake: Fix memory leak in tls_handshake_accept() - tipc: Fix use-after-free in tipc_mon_reinit_self(). - net: mdio: fix resource leak in mdiobus_register_device() - wifi: mac80211: skip rate verification for not captured PSDUs - af_unix: Initialise scc_index in unix_add_edge(). - net_sched: act_connmark: use RCU in tcf_connmark_dump() - net: sched: act_connmark: initialize struct tc_ife to fix kernel leak - net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak - net/mlx5e: Fix maxrate wraparound in threshold between units - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - net/mlx5e: Fix potentially misleading debug message - net_sched: limit try_bulk_dequeue_skb() batches - virtio-net: fix incorrect flags recording in big mode - hsr: Fix supervision frame sending on HSRv0 - [amd64] ACPI: CPPC: Detect preferred core availability on online CPUs - [amd64] ACPI: CPPC: Check _CPC validity for only the online CPUs - [amd64] ACPI: CPPC: Perform fast check switch only for online CPUs - [amd64] ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs - Bluetooth: L2CAP: export l2cap_chan_hold for modules - acpi,srat: Fix incorrect device handle check for Generic Initiator - regulator: fixed: fix GPIO descriptor leak on register failure - [arm64] ASoC: codecs: va-macro: fix resource leak in probe error path - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE - ASoC: tas2781: fix getting the wrong device number - pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect() - pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS - simplify nfs_atomic_open_v23() - NFSv2/v3: Fix error handling in nfs_atomic_open_v23() - NFS: sysfs: fix leak when nfs_client kobject add fails - NFSv4: Fix an incorrect parameter when calling nfs4_call_sync() - NFS: Fix LTP test failures when timestamps are delegated - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd - acpi/hmat: Fix lockdep warning for hmem_register_resource() - bpf: Add bpf_prog_run_data_pointers() - bpf: account for current allocated stack depth in widen_imprecise_scalars() - [riscv64] irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops - wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path - proc: fix the issue of proc_mem_open returning NULL - ext4: introduce ITAIL helper - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121) - Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981) - f2fs: fix to avoid overflow while left shift operation (CVE-2025-40077) - hostfs: Fix only passing host root in boot stage with new mount - virtio-fs: fix incorrect check for fsvq->kobj - fs/namespace: correctly handle errors returned by grab_requested_mnt_ns - sched_ext: Fix unsafe locking in the scx_dump_state() - Revert "netfilter: nf_tables: Reintroduce shortened deletion notifications" - netfilter: nf_tables: reject duplicate device on updates (CVE-2025-38678) - [arm64] dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1 - [arm64] dts: rockchip: Make RK3588 GPU OPP table naming less generic - [armhf] dts: imx51-zii-rdu1: Fix audmux node names - HID: hid-ntrig: Prevent memory leak in ntrig_report_version() - HID: playstation: Fix memory leak in dualshock4_get_calibration_data() - HID: uclogic: Fix potential memory leak in error path - [amd64] KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32_DEBUGCTLMSR is updated - nfsd: fix refcount leak in nfsd_set_fh_dentry() (CVE-2025-40212) - nfsd: add missing FATTR4_WORD2_CLONE_BLKSIZE from supported attributes - NFSD: free copynotify stateid in nfs4_free_ol_stateid() - ksmbd: close accepted socket when per-IP limit rejects connection - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item - strparser: Fix signed/unsigned mismatch bug - dma-mapping: benchmark: Restore padding to ensure uABI remained consistent - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe - nilfs2: avoid having an active sc_timer before freeing sci - wifi: mac80211: reject address change while connecting - fs/proc: fix uaf in proc_readdir_de() - mm/mm_init: fix hash table order logging in alloc_large_system_hash() - mm/shmem: fix THP allocation and fallback loop - mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4 - mmc: dw_mmc-rockchip: Fix wrong internal phase calculate - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer - cifs: client: fix memory leak in smb3_fs_context_parse_param - codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext - crash: fix crashkernel resource shrink - smb: client: fix cifs_pick_channel when channel needs reconnect - spi: Try to get ACPI GPIO IRQ earlier - [amd64] x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev - ftrace: Fix BPF fexit with livepatch - PM: hibernate: Emit an error when image writing fails - PM: hibernate: Use atomic64_t for compressed_size variable - btrfs: zoned: fix conventional zone capacity calculation - btrfs: scrub: put bio after errors in scrub_raid56_parity_stripe() - btrfs: do not update last_log_commit when logging inode due to a new name - btrfs: release root after error in data_reloc_print_warning_inode() - drm/amdkfd: relax checks for over allocation of save area - drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces - [arm64] pmdomain: arm: scmi: Fix genpd leak on provider registration failure - [armhf] pmdomain: imx: Fix reference count leak in imx_gpc_remove - [arm64,armhf] pmdomain: samsung: plug potential memleak during probe - mptcp: fix MSG_PEEK stream corruption - wifi: cfg80211: add an hrtimer based delayed work item - wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work - mm, percpu: do not consider sleepable allocations atomic - [amd64] KVM: guest_memfd: Pass index, not gfn, to __kvm_gmem_get_pfn() - [amd64] KVM: guest_memfd: Remove RCU-protected attribute from slot->gmem.file - [amd64] KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying - net: netpoll: Individualize the skb pool - net: netpoll: flush skb pool during cleanup - net: netpoll: fix incorrect refcount handling causing incorrect cleanup - [amd64] KVM: VMX: Split out guts of EPT violation to common/exposed function - [amd64] KVM: VMX: Fix check for valid GVA on an EPT violation - ALSA: hda: Fix missing pointer check in hda_component_manager_init function (CVE-2025-40097) - io_uring/napi: fix io_napi_entry RCU accesses - uio_hv_generic: Set event for all channels on the device (Closes: #1120602) - mm/memory: do not populate page table entries beyond i_size - mm/truncate: unmap large folio on split failure - mm/secretmem: fix use-after-free race in fault handler - mm/huge_memory: do not change split_huge_page*() target order silently - mm/huge_memory: preserve PG_has_hwpoisoned if a folio is split to >0 order - isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() - net: phy: micrel: Fix lan8814_config_init - net: netpoll: ensure skb_pool list is always initialized - proc: proc_maps_open allow proc_mem_open to return NULL - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (CVE-2025-40213) https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.60 - [arm64] KVM: arm64: Check the untrusted offset in FF-A memory share - timers: Fix NULL function pointer race in timer_shutdown_sync() - HID: amd_sfh: Stop sensor before starting - HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Closes: #1114557) - [arm64] dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5 - mtdchar: fix integer overflow in read/write ioctls - isofs: check the return value of sb_min_blocksize() in isofs_fill_super - shmem: fix tmpfs reconfiguration (remount) when noswap is set - exfat: check return value of sb_min_blocksize in exfat_read_boot_sector - mptcp: Disallow MPTCP subflows from sockmap - mptcp: Fix proto fallback detection with BPF - ata: libata-scsi: Fix system suspend for a security locked drive - smb: client: introduce close_cached_dir_locked() - ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan() - be2net: pass wrb_params in case of OS2BMC - [armhf] net: dsa: microchip: lan937x: Fix RGMII delay tuning - [arm64,armhf] Revert "drm/tegra: dsi: Clear enable register if powered by bootloader" - Input: cros_ec_keyb - fix an invalid memory access - Input: goodix - add support for ACPI ID GDIX1003 - Input: pegasus-notetaker - fix potential out-of-bounds access - mm/mempool: fix poisoning order>0 pages with HIGHMEM - nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() - scsi: sg: Do not sleep in atomic context - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() - dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups - mptcp: fix race condition in mptcp_schedule_work() - mptcp: fix ack generation for fallback msk - mptcp: fix duplicate reset on fastclose - mptcp: fix premature close in case of fallback - mptcp: avoid unneeded subflow-level drops - mptcp: decouple mptcp fastclose from tcp close - mptcp: do not fallback when OoO is present - [arm64,armhf] drm/tegra: dc: Fix reference leak in tegra_dc_couple() - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock - drm/amd: Skip power ungate during suspend for VPE - drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled - drm/amd/display: Increase DPCD read retries - drm/amd/display: Move sleep into each retry for retrieve_link_cap() - drm/amd/display: Fix pbn to kbps Conversion - drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5 - xfrm: drop SA reference in xfrm_state_update if dir doesn't match - xfrm: set err and extack on failure to create pcpu SA - xfrm: Determine inner GSO type from packet inner protocol - xfrm: Prevent locally generated packets from direct output in tunnel mode - [amd64] pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe() - mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() - [arm64,armhf] drm/tegra: Add call to put_pid() - net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get() - net: openvswitch: remove never-working support for setting nsh fields - nvme-multipath: fix lockdep WARN due to partition scan work - [s390x] ctcm: Fix double-kfree - [amd64] platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() - [amd64,arm64] idpf: fix possible vport_config NULL pointer deref in remove - ice: fix PTP cleanup on driver removal in error path - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy - net/mlx5: Clean up only new IRQ glue on request_irq() failure - af_unix: Cache state->msg in unix_stream_read_generic(). - af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic(). - cifs: fix memory leak in smb3_fs_context_parse_param error path - vsock: Ignore signal/timeout on connect() if already established - bcma: don't register devices disabled in OF - cifs: fix typo in enable_gcm_256 module parameter - scsi: core: Fix a regression triggered by scsi_host_busy() - [amd64] x86/microcode/AMD: Limit Entrysign signature checking to known generations - net: tls: Change async resync helpers argument - blk-crypto: use BLK_STS_INVAL for alignment errors - net: tls: Cancel RX async resync request on rcd_delta overflow - ALSA: usb-audio: Fix missing unlock at error path of maxpacksize check - [arm64] KVM: arm64: Make all 32bit ID registers fully writable - drm/xe: Prevent BIT() overflow when handling invalid prefetch region - [s390x] mm: Fix __ptep_rdp() inline assembly - ALSA: usb-audio: fix uac2 clock source at terminal parser - tracing/tools: Fix incorrcet short option in usage text for --threads - drm/amdgpu: fix gpu page fault after hibernation on PF passthrough - smb: client: fix incomplete backport in cfids_invalidation_worker() - tty/vt: fix up incorrect backport to stable releases - maple_tree: fix tracepoint string pointers - [amd64] drm/i915/dp_mst: Disable Panel Replay - mptcp: fix a race in mptcp_pm_del_add_timer() - xfs: Replace strncpy with memcpy - xfs: fix out of bounds memory read error in symlink repair - drm/amd/display: avoid reset DTBCLK at clock init - drm/amd/display: disable DPP RCG before DPP CLK enable - drm/amd/display: Insert dccg log for easy debug - drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched - Revert "gpio: swnode: don't use the swnode's name as the key for GPIO lookup" https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.61 - can: kvaser_usb: leaf: Fix potential infinite loop in command parsers - can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data - Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface - Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind - Bluetooth: SMP: Fix not generating mackey and ltk when repairing - net: sched: generalize check for no-queue qdisc on TX queue - veth: apply qdisc backpressure on full ptr_ring to reduce TX drops - veth: prevent NULL pointer dereference in veth_xdp_rcv - veth: more robust handing of race to avoid txq getting stuck - veth: reduce XDP no_direct return section to fix race - [amd64] platform/x86: intel: punit_ipc: fix memory corruption - net: aquantia: Add missing descriptor cache invalidation on ATL2 - net: lan966x: Fix the initialization of taprio - drm/xe: Fix conversion from clock ticks to milliseconds - net/mlx5e: Fix validation logic in rate limiting - team: Move team device type change at the end of team_port_add - drm/amdgpu: fix cyan_skillfish2 gpu info fw handling - net: wwan: mhi: Keep modem name match with Foxconn T99W640 - net: atlantic: fix fragment overflow handling in RX path - [arm64,armhf] net: fec: cancel perout_timer when PEROUT is disabled - [arm64,armhf] net: fec: do not update PEROUT if it is enabled - [arm64,armhf] net: fec: do not allow enabling PPS and PEROUT simultaneously - [arm64,armhf] net: fec: do not register PPS event for PEROUT - iio: st_lsm6dsx: Fixed calibrated timestamp calculation - [arm64] mailbox: mtk-cmdq: Refine DMA address handling for the command buffer - mailbox: pcc: Refactor error handling in irq handler into separate function - mailbox: pcc: don't zero error register - fs/namespace: fix reference leak in grab_requested_mnt_ns - spi: spi-mem: Allow specifying the byte order in Octal DTR mode - spi: spi-mem: Extend spi-mem operations with a per-operation maximum frequency - spi: spi-mem: Add a new controller capability - [arm64] spi: nxp-fspi: Support per spi-mem operation frequency switches - [arm64] spi: spi-nxp-fspi: remove the goto in probe - [arm64] spi: spi-nxp-fspi: Add OCT-DTR mode support - [arm64] spi: nxp-fspi: Propagate fwnode in ACPI case as well - Revert "drm/amd/display: Move setup_stream_attribute" - [amd64] Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" - iio: buffer-dma: support getting the DMA channel - iio: buffer-dmaengine: enable .get_dma_dev() - iio: buffer: support getting dma channel from the buffer - iio: accel: bmc150: Fix irq assumption regression (Closes: #1106411) - tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 - [arm64] dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity - Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref - can: sja1000: fix max irq loop handling - can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling - ceph: fix crash in process_v2_sparse_read() for encrypted directories - dm-verity: fix unreliable memory allocation - drivers/usb/dwc3: fix PCI parent check - smb: client: fix memory leak in cifs_construct_tcon() - [amd64] thunderbolt: Add support for Intel Wildcat Lake - [arm64] slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves - nvmem: layouts: fix nvmem_layout_bus_uevent - firmware: stratix10-svc: fix bug in saving controller data - mm/memfd: fix information leak in hugetlb folios - mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level - mptcp: clear scheduled subflows on retransmit - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). - [arm*] serial: amba-pl011: prefer dma_mapping_error() over explicit address checking - usb: cdns3: Fix double resource release in cdns3_pci_probe - usb: gadget: f_eem: Fix memory leak in eem_unwrap - usb: storage: Fix memory leak in USB bulk transport - USB: storage: Remove subclass and protocol overrides from Novatek quirk - usb: storage: sddr55: Reject out-of-bound new_pba - usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer - [amd64,arm64] usb: dwc3: pci: add support for the Intel Nova Lake -S - [amd64,arm64] usb: dwc3: pci: Sort out the Intel device IDs - [amd64,arm64] usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths - xhci: fix stale flag preventig URBs after link state error is cleared - xhci: dbgtty: Fix data corruption when transmitting data form DbC to host - xhci: dbgtty: fix device unregister - USB: serial: ftdi_sio: add support for u-blox EVK-M101 - USB: serial: option: add support for Rolling RW101R-GL - drm: sti: fix device leaks at component probe - drm/amd/amdgpu: reserve vm invalidation engine for uni_mes - drm/amd/display: Check NULL before accessing - drm/amd/display: Don't change brightness for disabled connectors - [armhf] net: dsa: microchip: common: Fix checks on irq_find_mapping() - [armhf] net: dsa: microchip: ptp: Fix checks on irq_find_mapping() - [armhf] net: dsa: microchip: Don't free uninitialized ksz_irq - libceph: fix potential use-after-free in have_mon_and_osd_map() - libceph: prevent potential out-of-bounds writes in handle_auth_session_key() - libceph: replace BUG_ON with bounds check for map->max_osd - staging: rtl8712: Remove driver using deprecated API wext - nfsd: Replace clamp_t in nfsd4_get_drc_mem() - usb: typec: ucsi: psy: Set max current to zero when disconnected - usb: udc: Add trace event for usb_gadget_set_state - usb: gadget: udc: fix use-after-free in usb_gadget_state_work - mm/huge_memory: fix NULL pointer deference when splitting folio - [amd64] KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts() - [amd64] KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv() - [amd64] KVM: nSVM: Fix and simplify LBR virtualization handling with nested - [amd64] KVM: SVM: Fix redundant updates of LBR MSR intercepts - drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup - [armhf] net: dsa: microchip: Do not execute PTP driver code for unsupported switches - [armhf] net: dsa: microchip: Free previously initialized ports on init failures - wifi: ath12k: correctly handle mcast packets for clients - Revert "ACPI: Suppress misleading SPCR console message when SPCR table is absent" - [amd64] drm/i915/dp: Initialize the source OUI write timestamp always - [arm64] spi: spi-nxp-fspi: Check return value of devm_mutex_init() https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.62 - xfrm: delete x->tunnel as we delete x - Revert "xfrm: destroy xfrm_state synchronously on net exit path" - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added - xfrm: flush all states in xfrm_state_fini - Documentation: process: Also mention Sasha Levin as stable tree maintainer - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted - ext4: refresh inline data size before write operations - ksmbd: ipc: fix use-after-free in ipc_msg_send_request - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() - [amd64] KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced - USB: serial: option: add Foxconn T99W760 - USB: serial: option: add Telit Cinterion FE910C04 new compositions - USB: serial: option: move Telit 0x10c7 composition in the right place - USB: serial: ftdi_sio: match on interface number for jtag - serial: add support of CPCI cards - USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC - USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC - ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct() - [arm64,armhf] ipi: imx: keep dma request disabled before dma transfer setup - drm/vmwgfx: Use kref in vmw_bo_dirty - Bluetooth: btrtl: Avoid loading the config file on security chips - smb: fix invalid username check in smb3_fs_context_parse_param() - drm/amdkfd: Fix GPU mappings for APU after prefetch - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series - bfs: Reconstruct file type when loading from disk - HID: hid-input: Extend Elan ignore battery quirk to USB - nvme: fix admin request_queue lifetime - [arm64] pinctrl: qcom: msm: Fix deadlock in pinmux configuration - [amd64] platform/x86: acer-wmi: Ignore backlight event - HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list - [amd64] platform/x86: huawei-wmi: add keys for HONOR models - [amd64] platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list - [amd64] platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally - HID: elecom: Add support for ELECOM M-XT3URBK (018F) - wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1 - wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1 - [amd64] comedi: check device's attached status in compat ioctls - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing - bus: mhi: host: pci_generic: Add Telit FN920C04 modem support - bus: mhi: host: pci_generic: Add Telit FN990B40 modem support https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.63 - [arm64,armhf] gpu: host1x: Fix race in syncpt alloc/free - [amd64] accel/ivpu: Prevent runtime suspend during context abort work - [amd64] accel/ivpu: Ensure rpm_runtime_put in case of engine reset/resume fail - [amd64] accel/ivpu: Make function parameter names consistent - [amd64] accel/ivpu: Fix DCT active percent format - drm/vgem-fence: Fix potential deadlock on release - USB: Fix descriptor count when handling invalid MBIM extended descriptor - [arm64] pinctrl: renesas: rzg2l: Fix PMC restore - [arm64] clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback - [arm64] clk: renesas: Use str_on_off() helper - [arm64] clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register - [arm64] clk: renesas: cpg-mssr: Read back reset registers to assure values latched - HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync() - objtool: Fix standalone --hacks=jump_label - objtool: Fix weak symbol detection - wifi: ath10k: Avoid vdev delete timeout when firmware is already down - wifi: ath10k: Add missing include of export.h - wifi: ath10k: move recovery check logic into a new work - wifi: ath11k: restore register window after global reset - sched/fair: Forfeit vruntime on yield - [arm*] irqchip/irq-brcmstb-l2: Fix section mismatch - [arm64,armhf] irqchip/imx-mu-msi: Fix section mismatch - [arm64] irqchip/renesas-rzg2l: Fix section mismatch - [riscv64] irqchip/starfive-jh8100: Fix section mismatch - [arm64] irqchip/qcom-irq-combiner: Fix section mismatch - crypto: authenc - Correctly pass EINPROGRESS back up to the caller - ntfs3: fix uninit memory after failed mi_read in mi_format_new - ntfs3: Fix uninit buffer allocated by __getname() - dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets - dt-bindings: clock: qcom,x1e80100-gcc: Add missing USB4 clocks/resets - clk: qcom: gcc-x1e80100: Add missing USB4 clocks/resets - rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu() - inet: Avoid ehash lookup race in inet_ehash_insert() - inet: Avoid ehash lookup race in inet_twsk_hashdance_schedule() - firmware: qcom: tzmem: fix qcom_tzmem_policy kernel-doc - block/mq-deadline: Introduce dd_start_request() - block/mq-deadline: Switch back to a single dispatch list - [arm64] dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props - [arm64] dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl - [arm64] dts: imx8mp-venice-gw702x: remove off-board uart - [arm64] dts: imx8mp-venice-gw702x: remove off-board sdhc1 - perf annotate: Check return value of evsel__get_arch() properly - [arm64] dts: exynos: gs101: fix sysreg_apm reg property - uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe - soc: Switch back to struct platform_driver::remove() - [arm64] soc: qcom: gsbi: fix double disable caused by devm - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - wifi: ath11k: fix VHT MCS assignment - wifi: ath11k: fix peer HE MCS assignment - [s390x] smp: Fix fallback CPU detection - [s390x] ap: Don't leak debug feature files if AP instructions are not available - [arm64] dts: ti: k3-am62p: Fix memory ranges for GPU - firmware: imx: scu-irq: fix OF node leak in - [arm64] dts: qcom: x1e80100: Fix compile warnings for USB HS controller - [arm64] dts: qcom: x1e80100: Add missing quirk for HS only USB controller - [arm64] dts: qcom: sdm845-oneplus: Correct gpio used for slider - [arm64] dts: qcom: sm8650: set ufs as dma coherent - [arm64] dts: qcom: qcm6490-shift-otter: Add missing reserved-memory - phy: mscc: Fix PTP for VSC8574 and VSC8572 - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). - RDMA/rxe: Fix null deref on srq->rq.queue after resize failure - Revert "mtd: rawnand: marvell: fix layouts" - [arm64,armhf] mtd: nand: relax ECC parameter validation check - perf: Remove get_perf_callchain() init_nr argument - bpf: Refactor stack map trace depth calculation into helper function - bpf: Fix stackmap overflow check in __bpf_get_stackid() - [amd64] perf/x86/intel/cstate: Remove PC3 support from LunarLake - task_work: Fix NMI race condition - [amd64] x86/dumpstack: Prevent KASAN false positive warnings in __show_regs() - tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set - [arm64] soc: qcom: smem: fix hwspinlock resource leak in probe error paths - [armhf] pinctrl: stm32: fix hwspinlock resource leak in probe function - i3c: fix refcount inconsistency in i3c_master_register - i3c: master: svc: Prevent incomplete IBI transaction - wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload() - [arm64] interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS - [arm64] dts: qcom: msm8996: add interconnect paths to USB2 controller - interconnect: debugfs: Fix incorrect error handling for NULL path - drm/imagination: Fix reference to devm_platform_get_and_ioremap_resource() - perf lock contention: Load kernel map before lookup - perf record: skip synthesize event when open evsel failed - power: supply: rt5033_charger: Fix device node reference leaks - power: supply: cw2015: Check devm_delayed_work_autocancel() return code - power: supply: max17040: Check iio_read_channel_processed() return code - power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges() - power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges() - power: supply: wm831x: Check wm831x_set_bits() return value - power: supply: apm_power: only unset own apm_get_power_status - scsi: target: Do not write NUL characters into ASCII configfs output - fs/9p: Don't open remote file with APPEND mode when writeback cache is used - [arm64] drm/panthor: Handle errors returned by drm_sched_entity_init() - [arm64] drm/panthor: Fix group_free_queue() for partially initialized queues - [arm64] drm/panthor: Fix UAF race between device unplug and FW event processing - [arm64] drm/panthor: Fix race with suspend during unplug - [arm64] drm/panthor: Fix UAF on kernel BO VA nodes - libbpf: Fix parsing of multi-split BTF - [armhf] dts: am335x-netcom-plus-2xx: add missing GPIO labels - [armhf] dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible - [armhf] dts: omap3: n900: Correct obsolete TWL4030 power compatible - [amd64] x86/boot: Fix page table access in 5-level to 4-level paging transition - efi/libstub: Fix page table access in 5-level to 4-level paging transition - ext4: correct the checking of quota files before moving extents - [amd64] perf/x86/intel: Correct large PEBS flag check - regulator: core: disable supply if enabling main regulator fails - md: fix rcu protection in md_wakeup_thread - nbd: defer config put in recv_work - scsi: stex: Fix reboot_notifier leak in probe error path - scsi: smartpqi: Fix device resources accessed after device removal - dt-bindings: PCI: amlogic: Fix the register name of the DBI region - RDMA/rtrs: server: Fix error handling in get_or_create_srv - ntfs3: init run lock for extend inode - [arm64] drm/panthor: Fix potential memleak of vma structure - scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc() - [amd64] cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs - [powerpc*] kdump: Fix size calculation for hot-removed memory ranges - [powerpc*] 32: Fix unpaired stwcx. on interrupt exit - wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper() - nbd: defer config unlock in nbd_genl_connect - coresight: Change device mode to atomic type - [arm64] coresight: etm4x: Correct polling IDLE bit - [arm64] coresight: etm4x: Extract the trace unit controlling - [arm64] coresight: etm4x: Add context synchronization before enabling trace - lib/vsprintf: Check pointer before dereferencing in time_and_date() - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() - ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() - scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls - leds: netxbig: Fix GPIO descriptor leak in error paths - bpf: Free special fields when update [lru_,]percpu_hash maps - PCI: keystone: Exit ks_pcie_probe() for invalid mode - [arm64] dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A - [arm64] dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A - [arm64] dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 3C - [amd64] crypto: iaa - Fix incorrect return value in save_iaa_wq() - [arm64] drm/msm/dpu: drop dpu_hw_dsc_destroy() prototype - ps3disk: use memcpy_{from,to}_bvec index - bpf: Handle return value of ftrace_set_filter_ip in register_fentry - bpf: Check skb->transport_header is set in bpf_skb_check_mtu - watchdog: wdat_wdt: Fix ACPI table leak in probe function - watchdog: starfive: Fix resource leak in probe error path - tracefs: fix a leak in eventfs_create_events_dir() - NFSD/blocklayout: Fix minlength check in proc_layoutget - block/blk-throttle: Fix throttle slice time for SSDs - [arm64] drm/msm/a2xx: stop over-complaining about the legacy firmware - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() - bpf: Fix invalid prog->stats access when update_effective_progs fails - [powerpc*] 64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit - [powerpc*] 64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format - fs/ntfs3: out1 also needs to put mi - fs/ntfs3: Prevent memory leaks in add sub record - [arm64] drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue - [arm64] drm/msm/a6xx: Flush LRZ cache before PT switch - [arm64] drm/msm/a6xx: Fix the gemnoc workaround - [arm64] drm/msm/a6xx: Improve MX rail fallback in RPMH vote init - ipv6: clear RA flags when adding a static route (Closes: #1117959) - pwm: bcm2835: Make sure the channel is enabled after pwm_request() - scsi: qla2xxx: Fix improper freeing of purex item - [amd64] iommu/vt-d: Fix unused invalidation hint in qi_desc_iotlb - wifi: mac80211: fix CMAC functions not handling errors - [arm64] mfd: mt6397-irq: Fix missing irq_domain_remove() in error path - [arm64] mfd: mt6358-irq: Fix missing irq_domain_remove() in error path - leds: rgb: leds-qcom-lpg: Don't enable TRILED when configuring PWM - [arm64] phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe() - [arm64] phy: rockchip: samsung-hdptx: Reduce ROPLL loop bandwidth - [arm64] phy: rockchip: samsung-hdptx: Prevent Inter-Pair Skew from exceeding the limits - net: phy: adin1100: Fix software power-down ready condition - cpuset: Treat cpusets in attaching as populated - wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb() - RAS: Report all ARM processor CPER information to userspace - ima: Handle error code returned by ima_filter_rule_match() - usb: chaoskey: fix locking for O_NONBLOCK - usb: dwc2: disable platform lowlevel hw resources during shutdown - usb: dwc2: fix hang during shutdown if set as peripheral - usb: dwc2: fix hang during suspend if set as peripheral - usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE - [riscv64] KVM: Fix guest page fault within HLV* instructions - erofs: limit the level of fs stacking for file-backed mounts - RDMA/bnxt_re: Fix the inline size for GenP7 devices - RDMA/bnxt_re: Pass correct flag for dma mr creation - ASoC: tas2781: correct the wrong period - mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() - firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc - staging: fbtft: core: fix potential memory leak in fbtft_probe_common() - [arm64] iommu/arm-smmu-v3: Fix error check in arm_smmu_alloc_cd_tables - btrfs: fix leaf leak in an error path in btrfs_del_items() - PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition - drm/nouveau: restrict the flush page to a 32-bit address - iomap: factor out a iomap_dio_done helper - iomap: always run error completions in user context - wifi: ieee80211: correct FILS status codes - backlight: led-bl: Add devlink to supplier LEDs - backlight: lp855x: Fix lp855x.h kernel-doc warnings - [arm64] iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal - RDMA/irdma: Fix data race in irdma_sc_ccq_arm - RDMA/irdma: Fix data race in irdma_free_pble - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY - [arm64] drm/panthor: Avoid adding of kernel BOs to extobj list - gfs2: Prevent recursive memory reclaim - firmware_loader: make RUST_FW_LOADER_ABSTRACTIONS select FW_LOADER - drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1() - hwmon: sy7636a: Fix regulator_enable resource leak on error path - ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 - ublk: prevent invalid access with DEBUG - ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation - of: Skip devicetree kunit tests when RISCV+ACPI doesn't populate root node - virtio_vdpa: fix misleading return in void function - virtio: fix typo in virtio_device_ready() comment - virtio: fix whitespace in virtio_config_ops - virtio: fix grammar in virtio_queue_info docs - virtio: fix virtqueue_set_affinity() docs - vdpa/mlx5: Fix incorrect error code reporting in query_virtqueues - vhost: Fix kthread worker cgroup failure handling - vdpa/pds: use %pe for ERR_PTR() in event handler registration - [amd64] ASoC: Intel: catpt: Fix error path in hw_params() - [armhf] dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend - [armhf] dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend - [armhf] dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend - [armhf] dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend - regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex - resource: replace open coded resource_intersection() - resource: introduce is_type_match() helper and use it - Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()" - netfilter: flowtable: check for maximum number of encapsulations in bridge vlan - netfilter: nf_conncount: rework API to use sk_buff directly - netfilter: nft_connlimit: update the count if add was skipped - net: stmmac: fix rx limit check in stmmac_rx_zc() - vfio/pci: Use RCU for error/request triggers to avoid circular locking - net: phy: aquantia: check for NVMEM deferral - mtd: lpddr_cmds: fix signed shifts in lpddr_cmds - [arm64] remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs - md/raid5: fix IO hang when array is broken with IO inflight - net: hsr: remove one synchronize_rcu() from hsr_del_port() - net: hsr: remove synchronize_rcu() from hsr_add_port() - net: hsr: Create and export hsr_get_port_ndev() - net: hsr: create an API to get hsr port type - net: dsa: xrs700x: reject unsupported HSR configurations - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CVE-2025-68325) - perf tools: Mark split kallsyms DSOs as loaded - perf tools: Fix split kallsyms DSO counting - perf hist: In init, ensure mem_info is put on error paths - [arm64,armhf] pinctrl: single: Fix incorrect type for error return variable - fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe() - 9p: fix cache/debug options printing in v9fs_show_options - sched/fair: Fix unfairness caused by stalled tg_load_avg_contrib when the last task migrates out - [amd64] platform/x86:intel/pmc: Update Arrow Lake telemetry GUID - f2fs: keep POSIX_FADV_NOREUSE ranges - f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages - f2fs: fix to avoid running out of free segments - f2fs: add carve_out sysfs node - f2fs: sysfs: add encoding_flags entry - f2fs: introduce reserved_pin_section sysfs entry - f2fs: add gc_boost_gc_multiple sysfs node - f2fs: add gc_boost_gc_greedy sysfs node - f2fs: maintain one time GC mode is enabled during whole zoned GC cycle - NFS: Avoid changing nlink when file removes and attribute updates race - fs/nls: Fix utf16 to utf8 conversion - NFS: Initialise verifiers for visible dentries in readdir and lookup - NFS: Initialise verifiers for visible dentries in nfs_atomic_open() - nfs/vfs: discard d_exact_alias() - NFS: Initialise verifiers for visible dentries in _nfs4_open_and_get_state - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid - Revert "nfs: ignore SB_RDONLY when remounting nfs" - Revert "nfs: clear SB_RDONLY before getting superblock" - Revert "nfs: ignore SB_RDONLY when mounting nfs" - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags - Expand the type of nfs_fattr->valid - NFS: Fix inheritance of the block sizes when automounting - fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8() - [amd64] platform/x86: asus-wmi: use brightness_set_blocking() for kbd led - blk-mq: Abort suspend when wakeup events are pending - block: fix comment for op_is_zone_mgmt() to include RESET_ALL - block: fix memory leak in __blkdev_issue_zero_pages - nvme-auth: use kvfree() for memory allocated with kvcalloc() - drm/plane: Fix IS_ERR() vs NULL check in drm_plane_create_hotspot_properties() - regulator: fixed: Rely on the core freeing the enable GPIO - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events - drm/nouveau: refactor deprecated strcpy - cifs: Fix handling of a beyond-EOF DIO/unbuffered read over SMB2 - docs: hwmon: fix link to g762 devicetree binding - dma/pool: eliminate alloc_pages warning in atomic_pool_expand - ALSA: uapi: Fix typo in asound.h comment - drm/amdkfd: Use huge page size to check split svm range alignment - rtc: gamecube: Check the return value of ioremap() - ALSA: firewire-motu: add bounds check in put_user loop for DSP events - block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock - block: return unsigned int from queue_dma_alignment - dm-raid: fix possible NULL dereference with undefined raid type - dm log-writes: Add missing set_freezable() for freezable kthread - efi/cper: Add a new helper function to print bitmasks - efi/cper: Adjust infopfx size to accept an extra space - efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs - scsi: imm: Fix use-after-free bug caused by unfinished delayed work (CVE-2025-68324) - irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() - ocfs2: fix memory leak in ocfs2_merge_rec_left() - net: lan743x: Allocate rings outside ZONE_DMA - net: dst: introduce dst->dev_rcu - tcp_metrics: use dst_dev_net_rcu() (CVE-2025-40075) - usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt - usb: phy: Initialize struct usb_phy list_head - usb: dwc3: dwc3_power_off_all_roothub_ports: Use ioremap_np when required - ALSA: dice: fix buffer overflow in detect_stream_formats() - ALSA: wavefront: Fix integer overflow in sample size validation [ Uwe Kleine-König ] * [armhf] Enable LEDS_TURRIS_OMNIA as a module for Turris Omnia LED support. [ Maxwell Pevner ] * drivers/hid: Enable HID_UNIVERSAL_PIDFF as module (Closes: #1122144) -- Salvatore Bonaccorso Tue, 30 Dec 2025 20:37:47 +0100 linux (6.12.57-1~bpo12+1) bookworm-backports; urgency=medium * Rebuild for bookworm-backports -- Ben Hutchings Mon, 17 Nov 2025 12:29:47 +0100 linux (6.12.57-1) trixie; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.49 - wifi: wilc1000: avoid buffer overflow in WID string configuration - nvme: fix PI insert on write - ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported - wifi: mac80211: increase scan_ies_len for S1G - wifi: mac80211: fix incorrect type for ret - cgroup: split cgroup_destroy_wq into 3 workqueues - btrfs: fix invalid extref key setup when replaying dentry - net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR - qed: Don't collect too many protection override GRC elements - bonding: set random address only when slaves already exist - mptcp: set remote_deny_join_id0 on SYN recv - mptcp: tfo: record 'deny join id0' info - net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure - ice: store max_frame and rx_buf_len only in ice_rx_ring - ice: fix Rx page leak on multi-buffer frames - i40e: remove redundant memory barrier when cleaning Tx descs - igc: don't fail igc_probe() on LED setup error - net/mlx5e: Harden uplink netdev access against device unbind - bonding: don't set oif to bond dev when getting NS target destination - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). - tls: make sure to abort the stream if headers are bogus - Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - net: liquidio: fix overflow in octeon_init_instr_queue() - cnic: Fix use-after-free bugs in cnic_delete_task - [arm64] octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() - [amd64] perf/x86/intel: Fix crash in icl_update_topdown_event() (CVE-2025-38322) - ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer - ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size - nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg - power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery - power: supply: bq27xxx: restrict no-battery detection to bq27000 - dm-raid: don't set io_min and io_opt for raid1 - dm-stripe: fix a possible integer overflow - gup: optimize longterm pin_user_pages() for large folio - mm: revert "mm: vmscan.c: fix OOM on swap stress test" - [amd64] iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() - [amd64] iommu/amd/pgtbl: Fix possible race while increase page table level - btrfs: tree-checker: fix the incorrect inode ref size check - [arm64] ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed - [arm64] ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S - mmc: mvsdio: Fix dma_unmap_sg() nents value - [amd64] KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active - drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer - rds: ib: Increment i_fastreg_wrs before bailing out - mptcp: propagate shutdown to subflows when possible - ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx - io_uring/cmd: let cmds to know about dying task - io_uring: backport io_should_terminate_tw() - io_uring: include dying ring in task_work "should cancel" state - io_uring/msg_ring: kill alloc_cache for io_kiocb allocations - io_uring/kbuf: drop WARN_ON_ONCE() from incremental length check (CVE-2025-39816) - [amd64] ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message - [amd64] ASoC: Intel: catpt: Expose correct bit depth to userspace - drm/xe/tile: Release kobject for the failure path - drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ - drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path - drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() - smb: client: fix filename matching of deferred files - smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) - crypto: af_alg - Set merge to zero early in af_alg_sendmsg - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path - io_uring: fix incorrect io_kiocb reference in io_link_skb - [amd64] platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 - [amd64] platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk - vmxnet3: unregister xdp rxq info in the reset path (CVE-2025-22106) - mm: add folio_expected_ref_count() for reference count calculation - mm/gup: check ref_count instead of lru before migration - mptcp: pm: nl: announce deny-join-id0 flag - usb: xhci: introduce macro for ring segment list iteration - usb: xhci: remove option to change a default ring's TRB cycle bit - xhci: dbc: decouple endpoint allocation from initialization - xhci: dbc: Fix full DbC transfer ring after several reconnects - rtc: pcf2127: fix SPI command byte for PCF2131 backport - minmax.h: add whitespace around operators and after commas - minmax.h: update some comments - minmax.h: reduce the #define expansion of min(), max() and clamp() - minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp() - minmax.h: move all the clamp() definitions after the min/max() ones - minmax.h: simplify the variants of clamp() - minmax.h: remove some #defines that are only expanded once https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.50 - scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE - firewire: core: fix overlooked update of subsystem ABI version - ALSA: usb-audio: Fix code alignment in mixer_quirks - ALSA: usb-audio: Fix block comments in mixer_quirks - ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks - ALSA: usb-audio: Avoid multiple assignments in mixer_quirks - ALSA: usb-audio: Simplify NULL comparison in mixer_quirks - ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks - ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 - ALSA: usb-audio: Convert comma to semicolon - ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA - ALSA: usb-audio: Fix build with CONFIG_INPUT=n - usb: core: Add 0x prefix to quirks debug output - [arm64,armhf] net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick - [riscv64] mmc: sdhci-cadence: add Mobileye eyeQ support - i2c: designware: Add quirk for Intel Xe - ALSA: usb-audio: Add DSD support for Comtrue USB Audio device - ALSA: usb-audio: move mixer_quirks' min_mute into common quirk - ALSA: usb-audio: Add mute TLV for playback volumes on more devices - net: sfp: add quirk for FLYPRO copper SFP+ module - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - [amd64] HID: amd_sfh: Add sync across amd sfh work functions - cpufreq: Initialize cpufreq-based invariance before subsys - smb: server: don't use delayed_work for post_recv_credits_work - smb: server: use disable_work_sync in transport_rdma.c - bpf: Check the helper function is valid in get_helper_proto - btrfs: don't allow adding block device of less than 1 MB - wifi: virt_wifi: Fix page fault on connect - bpf: Reject bpf_timer for PREEMPT_RT - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow - [armhf] can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow - can: peak_usb: fix shift-out-of-bounds issue - net: tun: Update napi->skb after XDP process - net/smc: fix warning in smc_rx_splice() when calling get_page() - [arm64] ethernet: rvu-af: Remove slash from the driver name - Bluetooth: hci_sync: Fix hci_resume_advertising_sync - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync - vhost: Take a reference on the task in struct vhost_task. - bnxt_en: correct offset handling for IPv6 destination address - net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS - nexthop: Forbid FDB status change while nexthop is in a group - mm/gup: local lru_add_drain() to avoid lru_add_drain_all() - mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" - mm: folio_may_be_lru_cached() unless folio_test_large() - [amd64] drm/gma500: Fix null dereference in hdmi teardown - futex: Prevent use-after-free during requeue-PI - [arm64] drm/panthor: Defer scheduler entitiy destruction to queue release - [amd64] platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() - smb: client: fix wrong index reference in smb2_compound_op() - HID: asus: add support for missing PX series fn keys - i40e: add validation for ring_len param - i40e: fix idx validation in i40e_validate_queue_map - i40e: fix idx validation in config queues msg - i40e: fix input validation logic for action_meta - i40e: fix validation of VF state in get resources - i40e: add max boundary check for VF filters - i40e: add mask to apply valid bits for itr_idx - i40e: improve VF MAC filters accounting - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx - tracing: dynevent: Add a missing lockdown check on dynevent - [armhf] dts: socfpga: sodia: Fix mdio bus probe and PHY address - drm/ast: Use msleep instead of mdelay for edid read - afs: Fix potential null pointer dereference in afs_put_server - fs/proc/task_mmu: check p->vec_buf for NULL - gpiolib: Extend software-node support to support secondary software-nodes - mm/hugetlb: fix folio is still mapped when deleted - fbcon: fix integer overflow in fbcon_do_set_font - fbcon: Fix OOB access in font allocation - iommufd: Fix race during abort for file descriptors - Revert "usb: xhci: remove option to change a default ring's TRB cycle bit" - [amd64] drm/i915/backlight: Return immediately when scale() finds invalid parameters https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.51 - crypto: sha256 - fix crash at kexec - scsi: target: target_core_configfs: Add length check to avoid buffer overflow - media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove - media: tuner: xc5000: Fix use-after-free in xc5000_release - media: rc: fix races with imon_disconnect() - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID - mm: swap: check for stable address space before operating on the VMA - wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() - [arm64] ASoC: qcom: audioreach: fix potential null pointer dereference https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.52 - wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() - USB: serial: option: add SIMCom 8230C compositions - Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 - wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 - wifi: rtl8xxxu: Don't claim USB ID 07b8:8188 - dm-integrity: limit MAX_TAG_SIZE to 255 - [amd64] platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - [amd64] platform/x86/amd/pmf: Support new ACPI ID AMDI0108 - [amd64,arm64] ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue - btrfs: ref-verify: handle damaged extent root tree - netfs: Prevent duplicate unlocking - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled - [amd64] platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list - drm/amd : Update MES API header file for v11 & v12 - drm/amd/include : MES v11 and v12 API header update - drm/amd/include : Update MES v12 API for fence update - drm/amdgpu: Enable MES lr_compute_wa by default (Closes: #1118658) - ALSA: usb-audio: Kill timer properly at removal (CVE-2025-38105) - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free - hid: fix I2C read buffer overflow in raw_event() for mcp2221 - nvmem: layouts: fix automatic module loading - binder: fix double-free in dbitmap - driver core/PM: Set power.no_callbacks along with power.no_pm - crypto: rng - Ensure set_ent is always present - net/9p: fix double req put in p9_fd_cancelled - [amd64] KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.53 - filelock: add FL_RECLAIM to show_fl_flags() macro - init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD - seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast - gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote - [powerpc*] 8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler - [powerpc*] 603: Really copy kernel PGD entries into all PGDIRs - uprobes: uprobe_warn should use passed task - [arm64] coresight: trbe: Prevent overflow in PERF_IDX2OFF() - [arm64] perf: arm_spe: Prevent overflow in PERF_IDX2OFF() - smb: server: fix IRD/ORD negotiation with the client - [amd64] EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller - [amd64] x86/vdso: Fix output operand size of RDPID - lsm: CONFIG_LSM can depend on CONFIG_SECURITY - btrfs: return any hit error from extent_writepage_io() - [arm64] pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read() - [arm64] dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0 - regmap: Remove superfluous check for !config in __regmap_init() - bpf: Remove migrate_disable in kprobe_multi_link_prog_run - libbpf: Fix reuse of DEVMAP - [arm64] dts: imx93-kontron: Fix GPIO for panel regulator - [arm64] dts: imx93-kontron: Fix USB port assignment - [arm64] dts: imx95: Correct the lpuart7 and lpuart8 srcid - ACPI: processor: idle: Fix memory leak when register cpuidle device failed - [arm64] soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS - [arm64] pinctrl: meson-gxl: add missing i2c_d pinmux - blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx - block: use int to store blk_stack_limits() return value - PM: sleep: core: Clear power.must_resume in noirq suspend error path - vdso: Add struct __kernel_old_timeval forward declaration to gettime.h - [armhf] dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property - [arm64] PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe() - [arm64] power: supply: cw2015: Fix a alignment coding style issue - [arm64] pinctrl: renesas: Use int type to store negative error codes - null_blk: Fix the description of the cache_size module argument - nbd: restrict sockets to TCP and UDP - [arm64] PM / devfreq: rockchip-dfi: double count on RK3588 - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure - [arm64] soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure - [arm64] arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model - mmc: core: Fix variable shadowing in mmc_route_rpmb_frames() - [arm64] dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value - [arm64] dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes - [arm64] dts: mediatek: mt8516-pumpkin: Fix machine compatible - [armhf] pwm: tiehrpwm: Don't drop runtime PM reference in .free() - [armhf] pwm: tiehrpwm: Make code comment in .free() more useful - [armhf] pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation - [armhf] pwm: tiehrpwm: Fix corner case in clock divisor calculation - ACPICA: Fix largest possible resource descriptor index - [riscv64] bpf: Sign extend struct ops return values properly - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op - i3c: master: svc: Use manual response for IBI events - i3c: master: svc: Recycle unused IBI slot - bpf: Explicitly check accesses to bpf_sock_addr - bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free() - smp: Fix up and expand the smp_call_function_many() kerneldoc - tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers - spi: fix return code when spi device has too many chipselects - bpf: Mark kfuncs as __noclone - once: fix race by moving DO_ONCE to separate section - [arm64] thermal/drivers/qcom/lmh: Add missing IRQ includes - [arm64] i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD - i2c: designware: Fix clock issue when PM is disabled - i2c: designware: Add disabling clocks when probe fails - libbpf: Fix error when st-prefix_ops and ops from differ btf - bpf: Enforce expected_attach_type for tailcall compatibility - drm/radeon/r600_cs: clean up of dead code in r600_cs - f2fs: fix condition in __allow_reserved_blocks() - [arm64] phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568 - drm/amd/display: Remove redundant semicolons - scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod - scsi: myrs: Fix dma_alloc_coherent() error check - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count - RDMA/mlx5: Fix vport loopback forcing for MPV device - PCI/ACPI: Fix pci_acpi_preserve_config() memory leak - ALSA: lx_core: use int type to store negative error codes - inet: ping: check sock_net() in ping_get_port() and ping_lookup() - [arm64,armhf] coresight: Only register perf symlink for sinks with alloc_buffer - drm/amdgpu: Power up UVD 3 for FW validation (v2) - drm/amd/pm: Disable ULV even if unsupported (v3) - drm/amd/pm: Fix si_upload_smc_data (v3) - drm/amd/pm: Adjust si_upload_smc_data register programming (v3) - drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3) - drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2) - drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3) - wifi: mwifiex: send world regulatory domain to driver - [arm64,armhf] PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation - tcp: fix __tcp_close() to only send RST when required - drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl() - [armhf] usb: phy: twl6030: Fix incorrect type for ret - usb: gadget: configfs: Correctly set use_os_string at bind - tty: n_gsm: Don't block input queue by waiting MSC - [powerpc*] misc: genwqe: Fix incorrect cmd field being reported in error - pps: fix warning in pps_register_cdev when register device fail - wifi: iwlwifi: Remove redundant header files - [amd64,arm64] idpf: fix Rx descriptor ready check barrier in splitq - [amd64] ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping - [amd64] ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping - [amd64] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping - [arm64] drm/msm/dpu: fix incorrect type for ret - fs: ntfs3: Fix integer overflow in run_unpack() - fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist - iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed() - iio: consumers: Fix offset handling in iio_convert_raw_to_processed() - netfilter: ipset: Remove unused htable_bits in macro ahash_region - ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable - drivers/base/node: handle error properly in register_one_node() - RDMA/cm: Rate limit destroy CM ID timeout error message - wifi: mt76: fix potential memory leak in mt76_wmac_probe() - wifi: mt76: mt7996: Fix RX packets configuration for primary WED device - wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE - wifi: mt76: mt7915: fix mt7981 pre-calibration - f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks() - f2fs: fix to truncate first page in error path of f2fs_truncate() - f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page() - ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT - ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message - scsi: qla2xxx: edif: Fix incorrect sign of error code - scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES() - scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp() - HID: hidraw: tighten ioctl command parsing - f2fs: fix zero-sized extent for precache extents - Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running" - RDMA/core: Resolve MAC of next-hop device without ARP support - IB/sa: Fix sa_local_svc_timeout_ms read race - Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram - wifi: ath12k: fix wrong logging ID used for CE - wifi: ath10k: avoid unnecessary wait for service ready message - iommu/vt-d: debugfs: Fix legacy mode page table dump logic - wifi: mac80211: fix Rx packet handling when pubsta information is not available - [amd64] ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback - RDMA/rxe: Fix race in do_task() when draining - wifi: rtw89: avoid circular locking dependency in ser_state_run() - [arm64] remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice - dm vdo: return error on corrupted metadata in start_restoring_volume functions - [arm64] coresight-etm4x: Conditionally access register TRCEXTINSELR - [arm64,armhf] coresight: tmc: Support atclk - [arm64,armhf] coresight: catu: Support atclk - [arm64,armhf] coresight: etm4x: Support atclk - [arm64,armhf] coresight: trbe: Return NULL pointer for allocation failures - [arm64,armhf] coresight: tpda: fix the logic to setup the element size - [arm64] coresight: Fix incorrect handling for return value of devm_kzalloc - NFSv4.1: fix backchannel max_resp_sz verification check - ipvs: Defer ip_vs_ftp unregister during netns cleanup - netfilter: nfnetlink: reset nlh pointer during batch replay - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() - usb: vhci-hcd: Prevent suspending virtually attached devices - iommu/vt-d: Disallow dirty tracking if incoherent page walk - net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast - ptp: Add a upper bound on max_vclocks - vhost: vringh: Fix copy_to_iter return value check - Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO - Bluetooth: ISO: Fix possible UAF on iso_conn_free - Bluetooth: ISO: free rx_skb if not consumed - Bluetooth: ISO: don't leak skb in ISO_CONT RX - Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements - KEYS: X.509: Fix Basic Constraints CA flag parsing - ocfs2: fix double free in user_cluster_connect() - drivers/base/node: fix double free in register_one_node() - [arm64] PCI: j721e: Fix incorrect error message in probe() - [amd64,arm64] idpf: fix mismatched free function for dma_alloc_coherent - nfp: fix RSS hash key size when RSS is not supported - net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable - net: dlink: handle copy_thresh allocation failure - net/mlx5: Stop polling for command response if interface goes down - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - net/mlx5: fw reset, add reset timeout work - smb: client: fix crypto buffers in non-linear memory - Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" - bpf: Reject negative offsets for ALU ops - tpm: Disable TPM2_TCG_HMAC by default - Squashfs: fix uninit-value in squashfs_get_parent - uio_hv_generic: Let userspace take care of interrupt mask - io_uring/waitid: always prune wait queue entry in io_waitid_wait() - [arm64] ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() - [amd64,arm64] ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down - fs: udf: fix OOB read in lengthAllocDescs handling - net: nfc: nci: Add parameter validation for packet data - [arm64,armhf] mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data() - dm: fix queue start/stop imbalance under suspend/load/resume races - dm: fix NULL pointer dereference in __dm_suspend() - ksmbd: Fix race condition in RPC handle list access - ksmbd: fix error code overwriting in smb2_get_info_filesystem() - ksmbd: add max ip connections parameter - ext4: fix checks for orphan inodes - [amd64] KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid - fbdev: simplefb: Fix use after free in simplefb_detach_genpds() - mm: hugetlb: avoid soft lockup when mprotect to large memory area - nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - [arm64] misc: fastrpc: Save actual DMA size in fastrpc_map structure - [arm64] misc: fastrpc: Fix fastrpc_map_lookup operation - [arm64] misc: fastrpc: fix possible map leak in fastrpc_put_args - [arm64] misc: fastrpc: Skip reference for DMA handles - Input: atmel_mxt_ts - allow reset GPIO to sleep - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak - sunrpc: fix null pointer dereference on zero-length checksum - [arm64] remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() - [amd64,arm64] tee: fix register_shm_helper() - pinctrl: check the return value of pinmux_ops::get_function_name() - bus: fsl-mc: Check return value of platform_get_resource() - net/9p: Fix buffer overflow in USB transport layer - net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock - usb: typec: tipd: Clear interrupts first https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.54 - fs: always return zero on success from replace_fd() - fscontext: do not consume log entries when returning -EMSGSIZE - [arm64] map [_text, _stext) virtual address range non-executable+read-only - rseq: Protect event mask against membarrier IPI - listmount: don't call path_put() under namespace semaphore - page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches - dma-mapping: fix direction in dma_alloc direction traces - [amd64] KVM: SVM: Emulate PERF_CNTR_GLOBAL_STATUS_SET for PerfMonV2 - iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE - media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() - asm-generic/io.h: Skip trace helpers if rwmmio events are disabled - perf disasm: Avoid undefined behavior in incrementing NULL - perf test trace_btf_enum: Skip if permissions are insufficient - perf evsel: Avoid container_of on a NULL leader - libperf event: Ensure tracing data is multiple of 8 sized - [arm64] clk: qcom: common: Fix NULL vs IS_ERR() check in qcom_cc_icc_register() - [arm64] clk: renesas: cpg-mssr: Fix memory leak in cpg_mssr_reserved_init() - perf util: Fix compression checks returning -1 as bool - perf arm_spe: Correct setting remote access - perf arm-spe: Rename the common data source encoding - perf arm_spe: Correct memory level for remote access - perf vendor events arm64 AmpereOneX: Fix typo - should be l1d_cache_access_prefetches - perf session: Fix handling when buffer exceeds 2 GiB - perf tools: Add fallback for exclude_guest - perf evsel: Ensure the fallback message is always written to - [arm64] clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m - [arm64] clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() - scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (CVE-2025-40001) - [amd64] ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time - [amd64] ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel - net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter() - drm/xe/hw_engine_group: Fix double write lock release in error path - [s390x] cio: Update purge function to unregister the unused subchannels - drm/vmwgfx: Fix a null-ptr access in the cursor snooper - drm/vmwgfx: Fix Use-after-free in validation - drm/vmwgfx: Fix copy-paste typo in validation - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). - [arm64] net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (CVE-2025-40003) - ice: ice_adapter: release xa entry on adapter allocation failure - tcp: take care of zero tp->window_clamp in tcp_set_rcvlowat() - [arm64] mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call - [arm64] mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes - [arm64] mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop - [arm64] mailbox: zynqmp-ipi: Fix SGI cleanup on unbind - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} - [arm64] mailbox: mtk-cmdq-mailbox: Switch to __pm_runtime_put_autosuspend() - [arm64] mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() - [arm64] mailbox: mtk-cmdq: Remove pm_runtime APIs from cmdq_mbox_send_data() - drm/amdgpu: Add additional DCE6 SCL registers - drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs - drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 - drm/amd/display: Properly disable scaling on DCE6 - netfilter: nft_objref: validate objref and objrefmap expressions - bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu() - crypto: essiv - Check ssize for decryption and in-place encryption - cifs: Fix copy_to_iter return value check - smb: client: fix missing timestamp updates after utime(2) - cifs: Query EA $LXMOD in cifs_query_path_info() for WSL reparse points - tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single - [arm64] gpio: wcd934x: mark the GPIO controller as sleeping - bpf: Avoid RCU context warning when unpinning htab with internal structs - [s390x] vmlinux.lds.S: Reorder sections - [s390x] vmlinux.lds.S: Move .vmlinux.info to end of allocatable sections - ACPI: property: Fix buffer properties extraction for subnodes - ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT - ACPI: debug: fix signedness issues in read/write helpers - [arm64] dts: qcom: msm8916: Add missing MDSS reset - [arm64] dts: qcom: msm8939: Add missing MDSS reset - [arm64] dts: qcom: sdm845: Fix slimbam num-channels/ees - [arm64] dts: qcom: x1e80100-pmics: Disable pm8010 by default - [arm64] dts: ti: k3-am62a-main: Fix main padcfg length - [arm64] kprobes: call set_memory_rox() for kprobe page - [armhf] AM33xx: Implement TI advisory 1.0.36 (EMU0/EMU1 pins state on reset) - [armhf] OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init - [arm64] perf/arm-cmn: Fix CMN S3 DTM offset - dt-bindings: phy: rockchip-inno-csi-dphy: make power-domains non-required - xen/events: Cleanup find_virq() return codes - xen/manage: Fix suspend error path - xen/events: Return -EEXIST for bound VIRQs - xen/events: Update virq_to_irq on migration - [arm64] firmware: meson_sm: fix device leak at probe - media: cx18: Add missing check after DMA map - media: mc: Fix MUST_CONNECT handling for pads with no links - media: pci: ivtv: Add missing check after DMA map - media: pci: mg4b: fix uninitialized iio scan data - [arm64] media: venus: firmware: Use correct reset sequence for IRIS2 - media: vivid: fix disappearing messages - media: lirc: Fix error handling in lirc_register() - [arm64] drm/panthor: Fix memory leak in panthor_ioctl_group_create() - drm/nouveau: fix bad ret code in nouveau_bo_move_prep - drm/xe/uapi: loosen used tracking restriction - drm/amd/display: Enable Dynamic DTBCLK Switch - blk-crypto: fix missing blktrace bio split events - btrfs: avoid potential out-of-bounds in btrfs_encode_fh() - bus: mhi: ep: Fix chained transfer handling in read path - bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup() - [arm64] clk: qcom: tcsrcc-x1e80100: Set the bi_tcxo as parent to eDP refclk - copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) - [amd64] cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() - [arm64,armhf] crypto: rockchip - Fix dma_unmap_sg() nents value - eventpoll: Replace rwlock with spinlock - fbdev: Fix logic error in "offb" name match - fs/ntfs3: Fix a resource leak bug in wnd_extend() - fs: quota: create dedicated workqueue for quota_release_work - fuse: fix possibly missing fuse_copy_finish() call in fuse_notify() - fuse: fix livelock in synchronous file put from fuseblk workers - iio: dac: ad5360: use int type to store negative error codes - iio: dac: ad5421: use int type to store negative error codes - iio: frequency: adf4350: Fix prescaler usage. - init: handle bootloader identifier in kernel parameters - iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume - [amd64] iommu/vt-d: PRS isn't usable if PDS isn't supported - kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths - KEYS: trusted_tpm1: Compare HMAC values in constant time - lib/genalloc: fix device leak in of_gen_pool_get() - loop: fix backing file reference leak on validation error - openat2: don't trigger automounts with RESOLVE_NO_XDEV - nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk - [powerpc*] powernv/pci: Fix underflow and leak issue - [powerpc*] pseries/msi: Fix potential underflow and leak issue - Revert "ipmi: fix msg stack when IPMI is disconnected" - sched/deadline: Fix race in push_dl_task() - scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() - scsi: sd: Fix build warning in sd_revalidate_disk() - sctp: Fix MAC comparison to be constant-time - xsk: Harden userspace-supplied xdp_desc validation - mmc: core: SPI mode remove cmd7 - mmc: mmc_spi: multiple block read remove read crc ack - [armhf] memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe - rtc: interface: Ensure alarm irq is enabled when UIE is enabled - rtc: interface: Fix long-standing race when setting alarm - [arm64] PCI: xilinx-nwl: Fix ECAM programming - [arm64,armhf] PCI: tegra: Convert struct tegra_msi mask_lock into raw spinlock - PCI/sysfs: Ensure devices are powered for config reads - PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV - PCI/ERR: Fix uevent on failure to recover - PCI/AER: Fix missing uevent on recovery when a reset is requested - PCI/AER: Support errors introduced by PCIe r6.0 - [arm64] PCI: j721e: Fix programming sequence of "strap" settings - spi: cadence-quadspi: Flush posted register writes before INDAC access - spi: cadence-quadspi: Flush posted register writes before DAC access - spi: cadence-quadspi: Fix cqspi_setup_flash() - [x86] fred: Remove ENDBR64 from FRED entry points - [x86] umip: Check that the instruction opcode is at least two bytes - [x86] umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) - [s390x] dasd: enforce dma_alignment to ensure proper buffer validation - [s390x] dasd: Return BLK_STS_INVAL for EINVAL from do_dasd_request - [s390x] Add -Wno-pointer-sign to KBUILD_CFLAGS_DECOMPRESSOR - slab: prevent warnings when slab obj_exts vector allocation fails - slab: mark slab->obj_exts allocation failures unconditionally - wifi: ath11k: HAL SRNG: don't deinitialize and re-initialize again - wifi: mt76: mt7925u: Add VID/PID for Netgear A9000 - wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 - mm/thp: fix MTE tag mismatch when replacing zero-filled subpages - mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations - mm/hugetlb: early exit from hugetlb_pages_alloc_boot() when max_huge_pages=0 - mm/damon/vaddr: do not repeat pte_offset_map_lock() until success - mm/damon/lru_sort: use param_ctx for damon_attrs staging - NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry - ext4: add ext4_sb_bread_nofail() helper function for ext4_free_branches() - ext4: verify orphan file size is not too big - ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch() - ext4: correctly handle queries for metadata mappings - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() - ext4: fix an off-by-one issue during moving extents - ext4: guard against EA inode refcount underflow in xattr update - ext4: validate ea_ino and size in check_xattrs - ACPICA: Allow to skip Global Lock initialization - ext4: free orphan info with kvfree - media: mc: Clear minor number before put device - Squashfs: add additional inode sanity checking - Squashfs: reject negative file sizes in squashfs_read_inode() - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference - mm/ksm: fix incorrect KSM counter handling in mm_struct during fork - [amd64] ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams - [amd64] ASoC: SOF: ipc4-pcm: fix delay calculation when DSP resamples - [amd64] mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value - [amd64] mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type - [amd64] mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag - btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() - cpufreq: Make drivers using CPUFREQ_ETERNAL specify transition latency - [amd64] KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace - statmount: don't call path_put() under namespace semaphore - [arm64] mte: Do not flag the zero page as PG_mte_tagged - [x86] mtrr: Rename mtrr_overwrite_state() to guest_force_mtrr_state() - [x86] kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP - nfsd: Fix NFSD_MAY_BYPASS_GSS and NFSD_MAY_BYPASS_GSS_ON_ROOT - NFSD: Replace use of NFSD_MAY_LOCK in nfsd4_lock() - nfsd: refine and rename NFSD_MAY_LOCK - nfsd: don't use sv_nrthreads in connection limiting calculations. - nfsd: unregister with rpcbind when deleting a transport - ACPI: battery: allocate driver data through devm_ APIs - ACPI: battery: initialize mutexes through devm_ APIs - ACPI: battery: Check for error code from devm_mutex_init() call - ACPI: battery: Add synchronization between interface updates - ACPI: property: Disregard references in data-only subnode lists - ACPI: property: Add code comments explaining what is going on - ACPI: property: Do not pass NULL handles to acpi_attach_data() - mptcp: pm: in-kernel: usable client side with C-flag - ipmi: Rework user message limit handling - ipmi: Fix handling of messages with provided receive message pointer - mm/rmap: fix soft-dirty and uffd-wp bit loss when remapping zero-filled mTHP subpage to shared zeropage - [s390x] bpf: Centralize frame offset calculations - [s390x] bpf: Describe the frame using a struct instead of constants - [s390x] bpf: Write back tail call counter for BPF_PSEUDO_CALL - [s390x] bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG - [riscv64] irqchip/sifive-plic: Make use of __assign_bit() - [riscv64] irqchip/sifive-plic: Avoid interrupt ID 0 handling during suspend/resume - copy_file_range: limit size if in compat mode - minixfs: Verify inode mode when loading from disk - pid: Add a judgment for ns null in pid_nr_ns - fs: Add 'initramfs_options' to set initramfs mount options - cramfs: Verify inode mode when loading from disk - writeback: Avoid softlockup when switching many inodes - writeback: Avoid excessively long inode switching times - sched/fair: Block delayed tasks on throttled hierarchy during dequeue - nfsd: fix __fh_verify for localio - nfsd: fix access checking for NLM under XPRTSEC policies - [amd64] ASoC: SOF: ipc4-pcm: fix start offset calculation for chain DMA - mount: handle NULL values in mnt_ns_release() - nfsd: decouple the xprtsec policy check from check_nfsd_access() https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.55 - drm/xe/guc: Check GuC running state before deregistering exec queue - smb: client: Fix refcount leak for cifs_sb_tlink - slab: reset slab->obj_ext when freeing and it is OBJEXTS_ALLOC_FAIL - r8152: add error handling in rtl8152_driver_init - f2fs: fix wrong block mapping for multi-devices - jbd2: ensure that all ongoing I/O complete before freeing blocks - ext4: wait for ongoing I/O to complete before freeing blocks - ext4: detect invalid INLINE_DATA + EXTENTS flag combination - btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running - btrfs: fix memory leak on duplicated memory in the qgroup assign ioctl - btrfs: fix incorrect readahead expansion length - btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST - btrfs: do not assert we found block group item when creating free space tree - can: gs_usb: gs_make_candev(): populate net_device->dev_port - can: gs_usb: increase max interface to U8_MAX - cifs: parse_dfs_referrals: prevent oob on malformed input - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies - drm/amdgpu: use atomic functions with memory barriers for vm fault info - drm/amdgpu: fix gfx12 mes packet status return check - perf/core: Fix address filter match with backing files - perf/core: Fix MMAP event path names with backing files - perf/core: Fix MMAP2 event device with backing files - drm/amd: Check whether secure display TA loaded successfully - irqdomain: cdx: Switch to of_fwnode_handle() - [arm64] drm/msm/a6xx: Fix PDC sleep sequence - usb: gadget: Store endpoint pointer in usb_request - usb: gadget: Introduce free_usb_request helper - usb: gadget: f_ncm: Refactor bind path to use __free() - usb: gadget: f_acm: Refactor bind path to use __free() - usb: gadget: f_ecm: Refactor bind path to use __free() - usb: gadget: f_rndis: Refactor bind path to use __free() - cpufreq: CPPC: Avoid using CPUFREQ_ETERNAL as transition delay - Revert "io_uring/rw: drop -EOPNOTSUPP check in __io_complete_rw_common()" (Closes: #1116358) - HID: multitouch: fix sticky fingers - dax: skip read lock assertion for read-only filesystems - can: m_can: m_can_plat_remove(): add missing pm_runtime_disable() - can: m_can: m_can_handle_state_errors(): fix CAN state transition to Error Active - can: m_can: m_can_chip_config(): bring up interface in correct state - can: m_can: add deinit callback - can: m_can: call deinit/init callback when going into suspend/resume - can: m_can: fix CAN state in system PM - net: dlink: handle dma_map_single() failure properly - doc: fix seg6_flowlabel path - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H - net/ip6_tunnel: Prevent perpetual tunnel growth - [amd64,arm64] amd-xgbe: Avoid spurious link down messages during interface toggle - tcp: fix tcp_tso_should_defer() vs large RTT - ksmbd: fix recursive locking in RPC handle list access - tg3: prevent use of uninitialized remote_adv and local_adv variables - tls: trim encrypted message to match the plaintext on short splice - tls: wait for async encrypt in case of error during latter iterations of sendmsg - tls: always set record_type in tls_process_cmsg - tls: wait for pending async decryptions if tls_strp_msg_hold fails - tls: don't rely on tx_work during send() - net: usb: lan78xx: Add error handling to lan78xx_init_mac_address - net: usb: lan78xx: fix use of improperly initialized dev->chipid in lan78xx_reset - [arm64] drm/panthor: Ensure MCU is disabled on suspend - nvme-multipath: Skip nr_active increments in RETRY disposition - [riscv64] kprobes: Fix probe address validation - [amd64] ASoC: nau8821: Cancel jdet_work before handling jack ejection - [amd64] ASoC: nau8821: Generalize helper to clear IRQ status - [amd64] ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit - [amd64] drm/i915/guc: Skip communication warning on reset in progress - drm/amdgpu: add ip offset support for cyan skillfish - drm/amdgpu: add support for cyan skillfish without IP discovery - drm/amdgpu: fix handling of harvesting for ip_discovery firmware - drm/amd/powerplay: Fix CIK shutdown temperature - [arm64] drm/rockchip: vop2: use correct destination rectangle height check - sched/fair: Fix pelt lost idle time detection - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card - HID: hid-input: only ignore 0 battery events for digitizers - HID: multitouch: fix name of Stylus input devices - nvme/tcp: handle tls partially sent records in write_space() - hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() - xfs: rename the old_crc variable in xlog_recover_process - xfs: fix log CRC mismatches between i386 and other architectures - PM: runtime: Add new devm functions - iio: imu: inv_icm42600: Simplify pm_runtime setup - iio: imu: inv_icm42600: Avoid configuring if already pm_runtime suspended - nfsd: Use correct error code when decoding extents - nfsd: Drop dprintk in blocklayout xdr functions - NFSD: Rework encoding and decoding of nfsd4_deviceid - NFSD: Minor cleanup in layoutcommit processing - NFSD: Implement large extent array support in pNFS - NFSD: Fix last write offset handling in layoutcommit - wifi: rtw89: avoid possible TX wait initialization race - xfs: use deferred intent items for reaping crosslinked blocks - padata: Reset next CPU when reorder sequence wraps around - md/raid0: Handle bio_split() errors - md/raid1: Handle bio_split() errors - md/raid10: Handle bio_split() errors - md: fix mssing blktrace bio split events - [amd64] x86/resctrl: Refactor resctrl_arch_rmid_read() - [amd64] x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID - d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier - vfs: Don't leak disconnected dentries on umount - PCI: Add PCI_VDEVICE_SUB helper macro - ixgbevf: Add support for Intel(R) E610 device - ixgbevf: fix getting link speed data for E610 devices - ixgbevf: fix mailbox API compatibility by negotiating supported features - tcp: convert to dev_net_rcu() - tcp: cache RTAX_QUICKACK metric in a hot cache line - net: dst: add four helpers to annotate data-races around dst->dev - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] - net: Add locking to protect skb->dev access in ip_output - mptcp: Call dst_release() in mptcp_active_enable(). - mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). - mptcp: reset blackhole on success with non-loopback ifaces - NFSD: Define a proc_layoutcommit for the FlexFiles layout type - [arm64] cputype: Add Neoverse-V3AE definitions - [arm64] errata: Apply workarounds for Neoverse-V3AE - [amd64] dmaengine: Add missing cleanup on module unload https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.56 - exec: Fix incorrect type for ret - hfs: clear offset and space out of valid records in b-tree node - hfs: make proper initalization of struct hfs_find_data - hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() - hfs: validate record offset in hfsplus_bmap_alloc - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() - dlm: check for defined force value in dlm_lockspace_release - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() - hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() - PCI: Test for bit underflow in pcie_set_readrq() - [arm64] sysreg: Correct sign definitions for EIESB and DoubleLock - drivers/perf: hisi: Relax the event ID check in the framework - [s390x] mm: Use __GFP_ACCOUNT for user page table allocations - smb: server: let smb_direct_flush_send_list() invalidate a remote key first - PM: EM: Drop unused parameter from em_adjust_new_capacity() - PM: EM: Slightly reduce em_check_capacity_update() overhead - PM: EM: Move CPU capacity check to em_adjust_new_capacity() - PM: EM: Fix late boot with holes in CPU topology - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - rtnetlink: Allow deleting FDB entries in user namespace - [arm64] net: enetc: fix the deadlock of enetc_mdio_lock - [arm64] net: enetc: correct the value of ENETC_RXB_TRUESIZE - [arm64] dpaa2-eth: fix the pointer passed to PTR_ALIGN on Tx path - net/mlx5e: Reuse per-RQ XDP buffer to avoid stack zeroing overhead - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ - net/smc: fix general protection fault in __smc_diag_dump - [arm64] net: ethernet: ti: am65-cpts: fix timestamp loss due to race conditions - [arm64] mm: avoid always making PTE dirty in pte_mkwrite() - ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop - sctp: avoid NULL dereference when chunk data buffer is missing - net: phy: micrel: always set shared->phydev for LAN8814 - net/mlx5: Fix IPsec cleanup over MPV device - fs/notify: call exportfs_encode_fid with s_umount - net: bonding: fix possible peer notify event loss or dup issue - dma-debug: don't report false positives with DMA_BOUNCE_UNALIGNED_KMALLOC - arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() - btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() - gpio: pci-idio-16: Define maximum valid register address offset - gpio: 104-idio-16: Define maximum valid register address offset - xfs: fix locking in xchk_nlinks_collect_dir - Revert "cpuidle: menu: Avoid discarding useful information" - slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts - slab: Fix obj_ext mistakenly considered NULL due to race condition - ACPICA: Work around bogus -Wstringop-overread warning since GCC 11 - can: netlink: can_changelink(): allow disabling of automatic restart - cifs: Fix TCP_Server_Info::credits to be signed - ocfs2: clear extent cache after moving/defragmenting extents - vsock: fix lock inversion in vsock_assign_transport() - [arm64,armhf] net: stmmac: dwmac-rk: Fix disabling set_clock_selection - net: usb: rtl8150: Fix frame padding - mm: prevent poison consumption when splitting THP - drm/amd/display: increase max link count and fix link->enc NULL pointer access - [arm64] spi: spi-nxp-fspi: add extra delay after dll locked - [arm64] dts: broadcom: bcm2712: Add default GIC address cells - [arm64] dts: broadcom: bcm2712: Define VGIC interrupt - [arm64] firmware: arm_scmi: Account for failed debug initialization - [arm64] firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode - [arm64] drm/panthor: Fix kernel panic on partial unmap of a GPU VA region - [riscv64] Define pgprot_dmacoherent() for non-coherent devices - [riscv64] Don't print details of CPUs disabled in DT - [riscv64] hwprobe: avoid uninitialized variable use in hwprobe_arch_id() - hwmon: (sht3x) Fix error handling - nbd: override creds to kernel when calling sock_{send,recv}msg() - drm/panic: Fix drawing the logo on a small narrow screen - drm/panic: Fix qr_code, ensure vmargin is positive - [amd64] gpio: ljca: Fix duplicated IRQ mapping - io_uring: correct __must_hold annotation in io_install_fixed_file - sched: Remove never used code in mm_cid_get() - io_uring/sqpoll: switch away from getrusage() for CPU accounting - io_uring/sqpoll: be smarter on when to update the stime usage - Bluetooth: btintel: Add DSBR support for BlazarIW, BlazarU and GaP (Closes: #1118660) - platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL (CVE-2025-39678) - USB: serial: option: add UNISOC UIS7720 - USB: serial: option: add Quectel RG255C - USB: serial: option: add Telit FN920C04 ECM compositions - usb/core/quirks: Add Huawei ME906S to wakeup quirk - usb: raw-gadget: do not limit transfer length - xhci: dbc: enable back DbC in resume if it was enabled before suspend - xhci: dbc: fix bogus 1024 byte prefix if ttyDBC read races with stall event - [amd64] x86/microcode: Fix Entrysign revision check for Zen1/Naples - [arm*] binder: remove "invalid inc weak" check - [amd64] comedi: fix divide-by-zero in comedi_buf_munge() (CVE-2025-40106) - [amd64] mei: me: add wildcat lake P DID - [arm64] misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup - [amd64,arm64] tcpm: switch check for role_sw device with fw_node - dt-bindings: usb: dwc3-imx8mp: dma-range is required only for imx8mp - serial: 8250_dw: handle reset control deassert error - serial: 8250_exar: add support for Advantech 2 port card with Device ID 0x0018 - [arm64] serial: 8250_mtk: Enable baud clock and manage in runtime PM - serial: sc16is7xx: remove useless enable of enhanced features - devcoredump: Fix circular locking dependency with devcd->mutex. - [arm64] mte: Do not warn if the page is already tagged in copy_highpage() - xfs: always warn about deprecated mount options - ksmbd: transport_ipc: validate payload size before reading handle (CVE-2025-40084) https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.57 - net/sched: sch_qfq: Fix null-deref in agg_dequeue (CVE-2025-40083) - audit: record fanotify event regardless of presence of rules - [amd64] perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK - perf: Use current->flags & PF_KTHREAD|PF_USER_WORKER instead of current->mm == NULL - perf: Have get_perf_callchain() return NULL if crosstask and user are set - perf: Skip user unwind if the task is a kernel thread - seccomp: passthrough uprobe systemcall without filtering - [amd64] x86/bugs: Report correct retbleed mitigation status - [amd64] x86/bugs: Fix reporting of LFENCE retpoline - [amd64,arm64] EDAC/mc_sysfs: Increase legacy channel support to 16 - cpuset: Use new excpus for nocpu error check when enabling root partition - btrfs: abort transaction on specific error places when walking log tree - btrfs: abort transaction in the process_one_buffer() log tree walk callback - btrfs: zoned: return error from btrfs_zone_finish_endio() - btrfs: zoned: refine extent allocator hint selection - btrfs: scrub: replace max_t()/min_t() with clamp() in scrub_throttle_dev_io() - btrfs: always drop log root tree reference in btrfs_replay_log() - btrfs: use level argument in log tree walk callback replay_one_buffer() - btrfs: abort transaction if we fail to update inode in log replay dir fixup - btrfs: tree-checker: add inode extref checks - btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() - sched_ext: Make qmap dump operation non-destructive - arch: Add the macro COMPILE_OFFSETS to all the asm-offsets.c - docs: kdoc: handle the obsolescensce of docutils.ErrorString() - mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR - f2fs: fix to avoid panic once fallocation fails for pinfile (CVE-2025-23130) - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() (CVE-2025-38643) - bonding: return detailed error when loading native XDP fails - bonding: check xdp prog when set bond mode (CVE-2025-22105) - bits: add comments and newlines to #if, #else and #endif directives - bits: introduce fixed-type GENMASK_U*() - gpio: regmap: Allow to allocate regmap-irq device - gpio: regmap: add the .fixed_direction_output configuration parameter - gpio: idio-16: Define fixed direction of the GPIO lines - [amd64] iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (CVE-2025-21833) - wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995) - [amd64,arm64] udmabuf: fix a buf size overflow issue during udmabuf creation (CVE-2025-37803) - sfc: fix NULL dereferences in ef100_process_design_param() (CVE-2025-37860) - btrfs: tree-checker: fix bounds check in check_inode_extref() [ Salvatore Bonaccorso ] * drivers/infiniband/hw/bnxt_re: Enable INFINIBAND_BNXT_RE as module (Closes: #1109977) [ Ben Hutchings ] * d/salsa-ci.yml: Adjust filenames to allow source package name suffix * tools/hv: Make the sample hv_get_dhcp_info script more useful * hyperv-daemons: Install the sample network info scripts (Closes: #919350) * d/salsa-ci.yml: Fix cache configuration for build job * d/salsa-ci.yml: Move orig tarball generation to a separate job again * d/salsa-ci.yml: Restore lintian checking of source package -- Salvatore Bonaccorso Wed, 05 Nov 2025 15:56:27 +0100 linux (6.12.48-1) trixie-security; urgency=high * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.44 - serial: 8250: fix panic due to PSLVERR - ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig - platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() - PM: runtime: Take active children into account in pm_runtime_get_if_in_use() - dm: dm-crypt: Do not partially accept write BIOs with zoned targets - dm: Check for forbidden splitting of zone write operations - usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() - usb: gadget: udc: renesas_usb3: fix device leak at unbind - usb: musb: omap2430: fix device leak at unbind - [arm64,armhf] usb: dwc3: meson-g12a: fix device leaks at unbind - [arm64] usb: dwc3: imx8mp: fix device leak at unbind - bus: mhi: host: Fix endianness of BHI vector table - bus: mhi: host: Detect events pointing to unexpected TREs - vt: keyboard: Don't process Unicode characters in K_OFF mode - vt: defkeymap: Map keycodes above 127 to K_HOLE - [amd64] crypto: qat - lower priority for skcipher and aead algorithms - [arm64,armhf] crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP - [amd64] crypto: qat - flush misc workqueue during device shutdown - Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" - ksmbd: fix refcount leak causing resource not released - ksmbd: extend the connection limiting mechanism to support IPv6 - tracing: fprobe-event: Sanitize wildcard for fprobe event name - ext4: check fast symlink for ea_inode correctly - ext4: fix fsmap end of range reporting with bigalloc - ext4: fix reserved gdt blocks handling in fsmap - ext4: use kmalloc_array() for array space allocation - ext4: fix hole length calculation overflow in non-extent inodes - btrfs: zoned: fix write time activation failure for metadata block group - btrfs: fix incorrect log message for nobarrier mount option - btrfs: restore mount option info messages during mount - btrfs: fix printing of mount info messages for NODATACOW/NODATASUM - apparmor: Fix 8-byte alignment for initial dfa blob streams - dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints - dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints - scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host - [arm64] scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE - scsi: mpi3mr: Fix race between config read submit and interrupt completion - ata: libata-scsi: Fix ata_to_sense_error() status handling - scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers - scsi: ufs: ufs-pci: Fix default runtime and system PM levels - ata: libata-scsi: Fix CDL control - [arm64] soc: qcom: mdt_loader: Ensure we don't read past the ELF header - iio: imu: bno055: fix OOB access of hw_xlate array - iio: adc: ad_sigma_delta: change to buffer predisable - wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() - wifi: ath12k: fix dest ring-buffer corruption - wifi: ath12k: fix source ring-buffer corruption - wifi: ath12k: fix dest ring-buffer corruption when ring is full - wifi: ath11k: fix dest ring-buffer corruption - wifi: ath11k: fix source ring-buffer corruption - wifi: ath11k: fix dest ring-buffer corruption when ring is full - [arm64] pwm: mediatek: Handle hardware enable and clock enable separately - [arm64] pwm: mediatek: Fix duty and period setting - mtd: spi-nor: Fix spi_nor_try_unlock_all() - [arm64] mtd: spinand: propagate spinand_wait() errors from spinand_write_page() - readahead: fix return value of page_cache_next_miss() when no hole is found - PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge - PCI: endpoint: Fix configfs group list head handling - PCI: endpoint: Fix configfs group removal on driver teardown - [arm64,armhf] PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features - [arm64,armhf] PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset - [arm64,armhf] PCI: imx6: Delay link start until configfs 'start' written - vsock/virtio: Validate length in packet header before skb_put() - vhost/vsock: Avoid allocating arbitrarily-sized SKBs - amdgpu/amdgpu_discovery: increase timeout limit for IFWI init - [amd64] ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context - f2fs: fix to avoid out-of-boundary access in dnode page (CVE-2025-38677) - jbd2: prevent softlockup in jbd2_log_do_checkpoint() - kbuild: userprogs: use correct linker when mixing clang and GNU ld - [arm64,armhf] soc/tegra: pmc: Ensure power-domains are in a known state - media: gspca: Add bounds checking to firmware parser - media: hi556: correct the test pattern configuration - [armhf] media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() - media: ipu6: isys: Use correct pads for xlate_streams() - media: vivid: fix wrong pixel_array control size - media: verisilicon: Fix AV1 decoder clock frequency - media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() - media: usbtv: Lock resolution while streaming - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() - media: pisp_be: Fix pm_runtime underrun in probe - media: ov2659: Fix memory leaks in ov2659_probe() - media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval - media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls - [arm64] media: qcom: camss: cleanup media device allocated resource on error path - [arm64] media: venus: Add a check for packet size after reading from shared memory - [arm64] media: venus: Fix MSM8998 frequency table - [arm64] media: venus: hfi: explicitly release IRQ during teardown - [arm64] media: venus: protect against spurious interrupts during probe - [arm64] media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. - [arm64] media: venus: venc: Clamp param smaller than 1fps and bigger than 240 - drm/amdgpu/discovery: fix fw based ip discovery - drm/amd: Restore cached power limit during resume - drm/amdgpu: Avoid extra evict-restore process. - drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities - drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() - drm/amdgpu: Update external revid for GC v9.5.0 - drm/amdgpu: update mmhub 3.0.1 client id mappings - drm/amdgpu: update mmhub 4.1.0 client id mappings - drm/amdkfd: Destroy KFD debugfs after destroy KFD wq - drm/amd/display: Add primary plane to commits for correct VRR handling - drm/amd/display: fix a Null pointer dereference vulnerability - drm/amd/display: Don't overwrite dce60_clk_mgr - net, hsr: reject HSR frame if skb can't hold tag - sched/ext: Fix invalid task state transitions on class switch - ipv6: sr: Fix MAC comparison to be constant-time - ACPI: pfr_update: Fix the driver update version check - mptcp: drop skb if MPTCP skb extension allocation fails - mptcp: pm: kernel: flush: do not reset ADD_ADDR limit - mm/damon/ops-common: ignore migration request to invalid nodes - [amd64] x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero - USB: typec: Use str_enable_disable-like helpers - usb: typec: fusb302: cache PD RX state - btrfs: qgroup: drop unused parameter fs_info from __del_qgroup_rb() - btrfs: qgroup: fix race between quota disable and quota rescan ioctl - btrfs: move transaction aborts to the error site in add_block_group_free_space() - btrfs: always abort transaction on failure to add block group to free space tree - btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() - btrfs: explicitly ref count block_group on new_bgs list - btrfs: codify pattern for adding block_group to bg_list - btrfs: zoned: requeue to unused block group list if zone finish failed - xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags - btrfs: send: factor out common logic when sending xattrs - btrfs: send: only use boolean variables at process_recorded_refs() - btrfs: send: add and use helper to rename current inode when processing refs - btrfs: send: keep the current inode's path cached - btrfs: send: avoid path allocation for the current inode when issuing commands - btrfs: send: use fallocate for hole punching with send stream v2 - btrfs: send: make fs_path_len() inline and constify its argument - netfs: Fix unbuffered write error handling - io_uring/net: commit partial buffers on retry - ata: libata-scsi: Return aborted command when missing sense and result TF - sched_ext: initialize built-in idle state before ops.init() - Revert "can: ti_hecc: fix -Woverflow compiler warning" - io_uring/futex: ensure io_futex_wait() cleans up properly on failure - iov_iter: iterate_folioq: fix handling of offset >= folio size - [arm64] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement - mmc: sdhci-pci-gli: Add a new function to simplify the code - memstick: Fix deadlock by moving removing flag earlier - mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER - mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency - NFS: Fix a race when updating an existing write - squashfs: fix memory leak in squashfs_fill_super - mm/debug_vm_pgtable: clear page table entries at destroy_args() - mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn - ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 - RDMA/rxe: Flush delayed SKBs while releasing RXE resources - [s390x] sclp: Fix SCCB present check - [amd64] platform/x86/intel-uncore-freq: Check write blocked for ELC - kvm: retry nx_huge_page_recovery_thread creation - [amd64] accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() - drm/amdgpu/swm14: Update power limit logic - drm/amd/display: Avoid a NULL pointer dereference - drm/amd/display: Don't overclock DCE 6 by 15% - drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 - drm/amd/display: Fix Xorg desktop unresponsive on Replay panel - drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. - drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs - drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs - scsi: core: Fix command pass through retry regression - [arm64] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() - mptcp: remove duplicate sk_reset_timer call - mptcp: disable add_addr retransmission when timeout is 0 - Mark xe driver as BROKEN if kernel page size is not 4kB - [arm64,armhf] PCI: imx6: Add i.MX8Q PCIe Endpoint (EP) support - [arm64,armhf] PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features - [arm64] PCI: rockchip: Use standard PCIe definitions - [arm64] PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining - iio: adc: ad7173: fix setting ODR in probe - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers - scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems - ext4: preserve SB_I_VERSION on remount - btrfs: subpage: keep TOWRITE tag until folio is cleaned - [arm64] dts: ti: k3-am6*: Add boot phase flag to support MMC boot - [arm64] dts: ti: k3-am62*: Add non-removable flag for eMMC - [arm64] dts: ti: k3-am6*: Remove disable-wp for eMMC - [arm64] dts: ti: k3-am62*: Move eMMC pinmux to top level board file - debugfs: fix mount options not being applied - smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() - fs/buffer: fix use-after-free when call bh_read() helper - use uniform permission checks for all mount propagation changes - cpuidle: menu: Remove iowait influence - cpuidle: governors: menu: Avoid selecting states with too much latency - drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS - [arm64] mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 - ftrace: Also allocate and copy hash for reading of filter files - iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() - iio: proximity: isl29501: fix buffered read on big-endian systems - most: core: Drop device reference after usage in get_channel() - kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() - cdx: Fix off-by-one error in cdx_rpmsg_probe() - usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive - [amd64] comedi: Make insn_rw_emulate_bits() do insn->n samples - [amd64] comedi: pcl726: Prevent invalid irq number - [amd64] comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() - usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test - usb: renesas-xhci: Fix External ROM access timeouts - USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera - usb: storage: realtek_cr: Use correct byte order for bcs->Residue - USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles - usb: typec: maxim_contaminant: disable low power mode when reading comparator values - usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean - usb: xhci: Fix slot_id resource race conflict - usb: dwc3: Ignore late xferNotReady event to prevent halt timeout - usb: dwc3: Remove WARN_ON for device endpoint command timeouts - usb: dwc3: pci: add support for the Intel Wildcat Lake - iio: light: Use aligned_s64 instead of open coding alignment. - iio: light: as73211: Ensure buffer holes are zeroed - iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() - tracing: Remove unneeded goto out logic - tracing: Limit access to parser->buffer when trace_get_user failed - [amd64] drm/i915/icl+/tc: Convert AUX powered WARN to a debug message - compiler: remove __ADDRESSABLE_ASM{_STR,}() again - [amd64] drm/i915/icl+/tc: Cache the max lane count value - ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() - tls: fix handling of zero-length records on the rx_list - iio: imu: inv_icm42600: switch timestamp type from int64_t __aligned(8) to aligned_s64 - iio: imu: inv_icm42600: use = { } instead of memset() - iio: imu: inv_icm42600: Convert to uXX and sXX integer types - iio: imu: inv_icm42600: change invalid data error to -EBUSY - [amd64] x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper - drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). - cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key - cgroup/cpuset: Fix a partition error with CPU hotplug - drm/panic: Move drawing functions to drm_draw - drm/format-helper: Add conversion from XRGB8888 to BGR888 - drm/format-helper: Move helpers for pixel conversion to header file - drm/format-helper: Add generic conversion to 32-bit formats - iosys-map: Fix undefined behavior in iosys_map_clear() - [arm64] RDMA/hns: Fix querying wrong SCC context for DIP algorithm - RDMA/bnxt_re: Fix to do SRQ armena by default - RDMA/bnxt_re: Fix to remove workload check in SRQ limit path - RDMA/bnxt_re: Fix a possible memory leak in the driver - RDMA/bnxt_re: Fix to initialize the PBL array - RDMA/hns: Fix dip entries leak on devices newer than hip09 - net: bridge: fix soft lockup in br_multicast_query_expired() - scsi: qla4xxx: Prevent a potential error pointer dereference - [amd64] iommu/amd: Avoid stack buffer overflow from kernel cmdline (CVE-2025-38676) - Bluetooth: hci_sync: Fix scan state after PA Sync has been established - Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown - Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF - Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established - Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() - [arm64] drm/hisilicon/hibmc: refactored struct hibmc_drm_private - [arm64] drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed - [arm64] drm/hisilicon/hibmc: fix the hibmc loaded failed bug - ALSA: usb-audio: Fix size validation in convert_chmap_v3() - drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() - drm/amd/display: Don't print errors for nonexistent connectors - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add - [arm64] net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path - ppp: fix race conditions in ppp_fill_forward_path - net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. - cifs: Fix oops due to uninitialised variable - phy: mscc: Fix timestamping for vsc8584 - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization - gve: prevent ethtool ops after shutdown - net/smc: fix UAF on smcsk after smc_listen_out() - [s390x] mm: Do not map lowcore with identity mapping - ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc - igc: fix disabling L1.2 PCI-E link substate on I226 on init - [armhf] net: dsa: microchip: Fix KSZ9477 HSR port setup issue - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit - net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate - ALSA: timer: fix ida_free call while not allocated - bonding: update LACP activity flag after setting lacp_active - bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU - [arm64] Octeontx2-af: Skip overlap check for SPI field - net/mlx5: Base ECVF devlink port attrs from 0 - net/mlx5: Relocate function declarations from port.h to mlx5_core.h - net/mlx5: Add IFC bits and enums for buf_ownership - net/mlx5e: Query FW for buffer ownership - net/mlx5e: Preserve shared buffer capacity during headroom updates - ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation - [s390x] hypfs: Avoid unnecessary ioctl registration in debugfs - [s390x] hypfs: Enable limited access during lockdown - netfilter: nf_reject: don't leak dst refcount for loopback packets https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.45 - rtla: Check pkg-config install - trace/fgraph: Fix the warning caused by missing unregister notifier - of: dynamic: Fix memleak when of_pci_add_properties() failed - of: dynamic: Fix use after free in of_changeset_add_prop_helper() - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump - perf symbol-minimal: Fix ehdr reading in filename__read_build_id - vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER - scsi: core: sysfs: Correct sysfs attributes access rights - smb: client: fix race with concurrent opens in unlink(2) - smb: client: fix race with concurrent opens in rename(2) - [arm64] ASoC: codecs: tx-macro: correct tx_macro_component_drv name - erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC - ACPI: EC: Add device to acpi_ec_no_wakeup[] qurik list - vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() - [arm64] drm/msm: Defer fd_install in SUBMIT ioctl - of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() - [arm64] drm/msm/kms: move snapshot init earlier in KMS init - [arm64] drm/msm: update the high bitfield of certain DSI registers - [arm64] drm/mediatek: Add error handling for old state CRTC in atomic_disable - [powerpc*] kvm: Fix ifdef to remove build warning - HID: input: rename hidinput_set_battery_charge_status() - HID: input: report battery status changes immediately - net: macb: fix unregister_netdev call order in macb_remove() - Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success - Bluetooth: hci_event: Mark connection as closed during suspend disconnect - Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced - Bluetooth: hci_sync: fix set_local_name race condition - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). - drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr - drm/nouveau: remove unused memory target test - ice: don't leave device non-functional if Tx scheduler config fails - ice: use fixed adapter index for E825C embedded devices - ice: fix incorrect counter for buffer allocation failures - dt-bindings: display/msm: qcom,mdp5: drop lut clock - net: dlink: fix multicast stats being counted incorrectly - drm/xe/xe_sync: avoid race during ufence signaling - drm/xe: Don't trigger rebind on initial dma-buf validation - phy: mscc: Fix when PTP clock is register and unregister - bnxt_en: Fix memory corruption when FW resources change during ifdown - bnxt_en: Adjust TX rings if reservation is less than requested - bnxt_en: Fix stats context reservation logic - net/mlx5: Reload auxiliary drivers on fw_activate - net/mlx5: Fix lockdep assertion on sync reset unload event - net/mlx5: Nack sync reset when SFs are present - net/mlx5e: Update and set Xon/Xoff upon MTU set - net/mlx5e: Update and set Xon/Xoff upon port speed set - net/mlx5e: Set local Xoff after FW update - net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts - net: stmmac: xgmac: Correct supported speed modes - net: stmmac: Set CIC bit only for TX queues with COE - [amd64,arm64] hv_netvsc: Link queues to NAPIs - [amd64,arm64] net: hv_netvsc: fix loss of early receive events from host during channel open. - net: rose: split remove and free operations in rose_remove_neigh() - net: rose: convert 'use' field to refcount_t - net: rose: include node references in rose_neigh refcount - sctp: initialize more fields in sctp_v6_from_sk() - l2tp: do not use sock_hold() in pppol2tp_session_get_sock() - fbnic: Move phylink resume out of service_task and into open/close - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare - net: macb: Disable clocks once - [amd64] KVM: x86: use array_index_nospec with indices that come from guest - [riscv64] KVM: fix stack overrun when loading vlenb - [amd64] x86/microcode/AMD: Handle the case of no BIOS microcode - [amd64] x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON - HID: asus: fix UAF via HID_CLAIMED_INPUT validation - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() - HID: quirks: add support for Legion Go dual dinput modes - HID: logitech: Add ids for G PRO 2 LIGHTSPEED - HID: wacom: Add a new Art Pen 2 - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() - Revert "drm/amdgpu: fix incorrect vm flags to map bo" - blk-zoned: Fix a lockdep complaint about recursive locking - dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted - fs/smb: Fix inconsistent refcnt update - net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions - smb3 client: fix return code mapping of remap_file_range - xfs: do not propagate ENODATA disk errors into xattr code - drm/xe/vm: Clear the scratch_pt pointer on error - drm/nouveau/disp: Always accept linear modifier - drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 - drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode - net: rose: fix a typo in rose_clear_routes() - PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS - PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up - Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" - [arm64] thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const - [arm64] thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data - [arm64] thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.46 - bpf: Add cookie object to bpf maps - bpf: Move bpf map owner out of common struct - bpf: Move cgroup iterator helpers to bpf.h - bpf: Fix oob access in cgroup local storage (CVE-2025-38502) - btrfs: fix race between logging inode and checking if it was logged before - btrfs: fix race between setting last_dir_index_offset and inode logging - btrfs: avoid load/store tearing races when checking if an inode was logged - cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN - drm/amd/display: Don't warn when missing DCE encoder caps - cpupower: Fix a bug where the -t option of the set subcommand was not working. - Bluetooth: hci_sync: Avoid adding default advertising on startup - btrfs: zoned: skip ZONE FINISH of conventional zones - fs: writeback: fix use-after-free in __mark_inode_dirty() - tee: fix NULL pointer dereference in tee_shm_put - tee: fix memory leak in tee_dyn_shm_alloc_helper - [arm64] dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro - [arm64] tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" - [arm64] dts: imx8mp-tqma8mpql: fix LDO5 power off - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM - [arm64] dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC - HID: simplify snto32() - HID: stop exporting hid_snto32() - HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556) - net: usb: qmi_wwan: fix Telit Cinterion FN990A name - net: usb: qmi_wwan: fix Telit Cinterion FE990A name - net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition - [arm64] mmc: sdhci-of-arasan: Support for emmc hardware reset - [arm64] mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up - wifi: cfg80211: fix use-after-free in cmp_bss() - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work - wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() - wifi: mt76: prevent non-offchannel mgmt tx during scan/roc - wifi: mt76: free pending offchannel tx frames on wcid cleanup - wifi: mt76: fix linked list corruption - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY - wifi: iwlwifi: uefi: check DSM item validity - Bluetooth: vhci: Prevent use-after-free by removing debugfs files early - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() - netfilter: nft_flowtable.sh: re-run with random mtu sizes - net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y - [amd64] xirc2ps_cs: fix register access when enabling FullDuplex - mISDN: Fix memory leak in dsp_hwec_enable() - bnxt_en: fix incorrect page count in RX aggr ring log - icmp: fix icmp_ndo_send address translation for reply direction - net: macb: Fix tx_ptr_lock locking - macsec: read MACSEC_SA_ATTR_PN with nla_get_uint - net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() - net: mctp: mctp_fraq_queue should take ownership of passed skb - ice: fix NULL access of tx->in_use in ice_ll_ts_intr - [amd64,arm64] idpf: set mac type when adding and removing MAC filters - i40e: remove read access to debugfs files - i40e: Fix potential invalid access when MAC list is empty - ixgbe: fix incorrect map used in eee linkmode - wifi: ath11k: fix group data packet drops during rekey - net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 - [arm64] net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets - net: skb: add pskb_network_may_pull_reason() helper - net: tunnel: add pskb_inet_may_pull_reason() helper - net: vxlan: add skb drop reasons to vxlan_rcv() - net: vxlan: make vxlan_snoop() return drop reasons - vxlan: Fix NPD when refreshing an FDB entry with a nexthop object - net: vxlan: make vxlan_set_mac() return drop reasons - net: vxlan: use kfree_skb_reason() in vxlan_xmit() - net: vxlan: use kfree_skb_reason() in vxlan_mdb_xmit() - net: vxlan: rename SKB_DROP_REASON_VXLAN_NO_REMOTE - vxlan: Refresh FDB 'updated' time upon 'NTF_USE' - vxlan: Avoid unnecessary updates to FDB 'used' time - vxlan: Add RCU read-side critical sections in the Tx path - vxlan: Rename FDB Tx lookup function - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects - wifi: cw1200: cap SSID length in cw1200_do_join() - wifi: libertas: cap SSID len in lbs_associate() - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() - [arm64] net: thunder_bgx: add a missing of_node_put - [arm64] net: thunder_bgx: decrement cleanup index before use - ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() - net/smc: Remove validation of reserved bits in CLC Decline message - mctp: return -ENOPROTOOPT for unknown getsockopt options - ax25: properly unshare skbs in ax25_kiss_rcv() - net: atm: fix memory leak in atm_register_sysfs when device_register fail - ppp: fix memory leak in pad_compress_skb - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock - ALSA: usb-audio: Add mute TLV for playback volumes on some devices - [amd64] accel/ivpu: Prevent recovery work from being queued during device removal - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() - [arm64] ftrace: fix unreachable PLT for ftrace_caller in init_module with CONFIG_DYNAMIC_FTRACE - pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() - io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453) - [amd64] x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() - mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE - mm: move page table sync declarations to linux/pgtable.h - mm: fix possible deadlock in kmemleak - mm: slub: avoid wake up kswapd in set_track_prepare - sched: Fix sched_numa_find_nth_cpu() if mask offline - ocfs2: prevent release journal inode after journal shutdown - of_numa: fix uninitialized memory nodes causing kernel panic - [arm64] soc: qcom: mdt_loader: Deal with zero e_shentsize - wifi: mwifiex: Initialize the chan_stats array to zero - wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete - wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() - wifi: mt76: mt7925: fix the wrong bss cleanup for SAP - net: ethernet: oa_tc6: Handle failure of spi_setup - drm/amdgpu: drop hw access in non-DC audio fini - drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG - [amd64] platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list - scsi: lpfc: Fix buffer free/clear order in deferred receive path - batman-adv: fix OOB read/write in network-coding decode - cifs: prevent NULL pointer dereference in UTF16 conversion - e1000e: fix heap overflow in e1000_set_eeprom - net: pcs: rzn1-miic: Correct MODCTRL register offset - fs/fhandle.c: fix a race in call of has_locked_children() (CVE-2025-38306) - [arm64,armhf] net: dsa: add hook to determine whether EEE is supported - [arm64,armhf] net: dsa: provide implementation of .support_eee() - [armhf] net: dsa: b53/bcm_sf2: implement .support_eee() method - [armhf] net: dsa: b53: do not enable EEE on bcm63xx (CVE-2025-38272) - md/raid1,raid10: don't ignore IO flags (CVE-2025-22125) - md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT - md/raid1,raid10: strip REQ_NOWAIT from member bios - ext4: define ext4_journal_destroy wrapper - ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113) - wifi: ath11k: update channel list in reg notifier instead reg worker (CVE-2025-23133) - wifi: ath11k: update channel list in worker when wait flag is set - net: fix NULL pointer dereference in l3mdev_l3_rcv (CVE-2025-22103) - md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb (CVE-2025-22124) - mm: slub: Print the broken data before restoring them - mm: slub: call WARN() when detecting a slab corruption - mm, slab: cleanup slab_bug() parameters - mm/slub: avoid accessing metadata when pointer is invalid in object_err() - nouveau: fix disabling the nonstall irq due to storm code - mm: fix accounting of memmap pages - [arm64] thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold - ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model - ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY - Revert "drm/amdgpu: Avoid extra evict-restore process." - pcmcia: omap: Add missing check for platform_get_resource - pcmcia: Add error handling for add_interval() in do_validate_mem() - [amd64] platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk - [amd64] platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID - block: add a queue_limits_commit_update_frozen helper - scsi: sr: Reinstate rotational media flag - drm/bridge: ti-sn65dsi86: fix REFCLK setting - perf bpf-event: Fix use-after-free in synthesis - perf bpf-utils: Constify bpil_array_desc - perf bpf-utils: Harden get_bpf_prog_info_linear - drm/amd/amdgpu: Fix missing error return on kzalloc failure - tools: gpio: remove the include directory on make clean - md: prevent incorrect update of resync/recovery offset - [riscv64] ACPI: RISC-V: Fix FFH_CPPC_CSR error handling - [riscv64] Only allow LTO with CMODEL_MEDANY - [riscv64] use lw when reading int cpu in new_vmalloc_check - [riscv64] use lw when reading int cpu in asm_per_cpu - [riscv64] bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG - [riscv64] bpf: use lw when reading int cpu in bpf_get_smp_processor_id - md/raid1: fix data lost for writemostly rdev https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.47 - [amd64] Add mitigations for VMSCAPE (CVE-2025-40300): - Documentation/hw-vuln: Add VMSCAPE documentation - x86/vmscape: Enumerate VMSCAPE bug - x86/vmscape: Add conditional IBPB mitigation - x86/vmscape: Enable the mitigation - x86/bugs: Move cpu_bugs_smt_update() down - x86/vmscape: Warn when STIBP is disabled with SMT - x86/vmscape: Add old Intel CPUs to affected list https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.48 - fhandle: use more consistent rules for decoding file handle from userns - dma-debug: store a phys_addr_t in struct dma_debug_entry - dma-mapping: trace dma_alloc/free direction - dma-mapping: use trace_dma_alloc for dma_alloc* instead of using trace_dma_map - dma-mapping: trace more error paths - dma-debug: don't enforce dma mapping check on noncoherent allocations - net/mlx5: HWS, change error flow on matcher disconnect - mm: introduce and use {pgd,p4d}_populate_kernel() - dma-mapping: fix swapped dir/flags arguments to trace_dma_alloc_sgt_err - dma-debug: fix physical address calculation for struct dma_debug_entry - nvme-pci: skip nvme_write_sq_db on empty rqlist - Revert "udmabuf: fix vmap_udmabuf error page set" - ext4: introduce linear search for dentries - [amd64] drm/i915/pmu: Fix zero delta busyness issue - drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed - Revert "drm/amd/display: Optimize cursor position updates" - ALSA: hda/realtek: Fix built-in mic assignment on ASUS VivoBook X515UA - drm/amdgpu: Add back JPEG to video caps for carrizo and newer - flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read - SUNRPC: call xs_sock_process_cmsg for all cmsg - NFSv4: Don't clear capabilities that won't be reset (Closes: #1114898) - trace/fgraph: Fix error handling - tracing: Fix tracing_marker may trigger page fault during preempt_disable - nfs/localio: remove extra indirect nfs_to call to check {read,write}_iter - nfs/localio: add direct IO enablement with sync and async IO support - nfs/localio: restore creds before releasing pageio data - ftrace/samples: Fix function size computation - fs/nfs/io: make nfs_start_io_*() killable - NFS: Serialise O_DIRECT i/o and truncate() - NFSv4.2: Serialise O_DIRECT i/o and fallocate() - NFSv4.2: Serialise O_DIRECT i/o and clone range - NFSv4.2: Serialise O_DIRECT i/o and copy range - NFS: nfs_invalidate_folio() must observe the offset and size arguments - NFSv4/flexfiles: Fix layout merge mirror check. - tracing: Silence warning when chunk allocation fails in trace_pid_write - [s390x] pai: Deny all events not handled by this PMU - [s390x] cpum_cf: Deny all sampling events by counter PMU - bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt - bpf: Allow fall back to interpreter for programs with stack size <= 512 - bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. - proc: fix type confusion in pde_set_flags() - Revert "SUNRPC: Don't allow waiting for exiting tasks" - mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN - ocfs2: fix recursive semaphore deadlock in fiemap call - btrfs: fix squota compressed stats leak - btrfs: fix subvolume deletion lockup caused by inodes xarray race - [amd64] i2c: i801: Hide Intel Birch Stream SoC TCO WDT - net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups - [armhf] mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer - [armhf] mtd: rawnand: stm32_fmc2: fix ECC overwrite - fuse: do not allow mapping a non-regular backing file - fuse: check if copy_file_range() returns larger than requested size - fuse: prevent overflow in copy_file_range return value - mm/khugepaged: fix the address passed to notifier on testing young - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory - mm/memory-failure: fix redundant updates for already poisoned pages - mm/damon/core: set quota->charged_from to jiffies at first charge window - mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() - [arm64] drm/mediatek: fix potential OF node use-after-free - drm/xe: Attempt to bring bos back to VRAM after eviction - drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time - drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages - netlink: specs: mptcp: add missing 'server-side' attr - netlink: specs: mptcp: clearly mention attributes - netlink: specs: mptcp: replace underscores with dashes in names - netlink: specs: mptcp: fix if-idx attribute type - kernfs: Fix UAF in polling when open file is released - libceph: fix invalid accesses to ceph_connection_v1_info - ceph: fix race condition validating r_parent before applying state - ceph: fix race condition where r_parent becomes stale before sending message - mm/damon/sysfs: fix use-after-free in state_show() - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() - [arm64] mtd: spinand: winbond: Fix oob_layout for W25N01JW - btrfs: use readahead_expand() on compressed extents - btrfs: fix corruption reading compressed range when block size is smaller than page size - hrtimers: Unconditionally update target CPU base after offline timer migration - Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table - Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" - tty: hvc_console: Call hvc_kick in hvc_write unconditionally - dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks - USB: serial: option: add Telit Cinterion FN990A w/audio compositions - USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions - [arm64] drm/panthor: validate group queue count - [arm64,armhf] net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() - genetlink: fix genl_bind() invoking bind() after -EPERM - net: bridge: Bounce invalid boolopts - tunnels: reset the GSO metadata before reusing the skb - docs: networking: can: change bcm_msg_head frames member to support flexible array - igb: fix link test skipping when interface is admin down - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path - drm/amd/display: use udelay rather than fsleep - can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed - can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails - netfilter: nft_set_pipapo: remove unused arguments - netfilter: nft_set: remove one argument from lookup and update functions - netfilter: nft_set_pipapo: merge pipapo_get/lookup - netfilter: nft_set_pipapo: don't return bogus extension pointer - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups - netfilter: nft_set_rbtree: continue traversal if element is inactive - netfilter: nf_tables: Reintroduce shortened deletion notifications - netfilter: nf_tables: place base_seq in struct net - netfilter: nf_tables: make nft_set_do_lookup available unconditionally - netfilter: nf_tables: restart set lookup on base_seq change - net: hsr: Add VLAN CTAG filter support - hsr: use rtnl lock when iterating over ports - hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr - [arm64] phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties - [amd64] dmaengine: idxd: Remove improper idxd_free - [amd64] dmaengine: idxd: Fix refcount underflow on module unload - [amd64] dmaengine: idxd: Fix double free in idxd_setup_wqs() - [amd64] dmaengine: ti: edma: Fix memory allocation size for queue_priority_map - xhci: fix memory leak regression when freeing xhci vdev devices depth first - USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels - [amd64,arm64] usb: typec: tcpm: properly deliver cable vdms to altmode drivers - [arm64] dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees - [arm64] phy: tegra: xusb: fix device and OF node leak at probe - [armhf] phy: ti: omap-usb2: fix device leak at unbind - [armhf] phy: ti-pipe3: fix device leak at unbind - [amd64] x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon - net: mdiobus: release reset_gpio in mdiobus_unregister_device() - [amd64] drm/i915/power: fix size for for_each_set_bit() in abox iteration - drm/amdgpu: fix a memory leak in fence cleanup when unloading - netfilter: nft_set_pipapo: fix null deref for empty set [ Santiago Ruano Rincón ] * d/salsa-ci.yml: Merge the extract-source job into the build's job script * d/salsa-ci.yml: Suppress unreleased changes and mismatching distribution lintian tags. * d/salsa-ci.yml: Early move orig tarballs back where they can be cached [ Salvatore Bonaccorso ] * [rt] Add new signing key for Daniel Wagner * [rt] Update to 6.12.43-rt12 * [amd64] x86/bugs: Add SRSO_USER_KERNEL_NO support * [amd64] x86/bugs: KVM: Add support for SRSO_MSR_FIX * [amd64] KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 <=> 1 VM count transitions -- Salvatore Bonaccorso Sat, 20 Sep 2025 20:41:31 +0200 --- Cambios de base-files --- base-files (12.4+deb12u15) bookworm; urgency=medium * Change /etc/debian_version to 12.15, for Debian 12.15 point release. -- Santiago Vila Thu, 02 Jul 2026 21:05:00 +0200 base-files (12.4+deb12u14) bookworm; urgency=medium * Change /etc/debian_version to 12.14, for Debian 12.14 point release. -- Santiago Vila Fri, 08 May 2026 18:15:00 +0200 base-files (12.4+deb12u13) bookworm; urgency=medium * Change /etc/debian_version to 12.13, for Debian 12.13 point release. -- Santiago Vila Fri, 02 Jan 2026 13:40:00 +0100 --- Cambios de btrfs-progs --- btrfs-progs (6.2-1+deb12u2) bookworm; urgency=medium * Acknowledge NMU. * Cherry pick upstream commit:cba1ef1 "btrfs-progs: dev stats: fix printing wrong values in tabular output" because this bug hides file and/or metadata corruption that requires sysadmin action; That action is `btrfs scrub`, which repairs the bad data (when there is a 2nd copy ie: raid1 profile). If a 2nd copy is not available then the necessity of having to restore corrupted files from backup (in profile=single) will no longer be hidden. Thanks to Craig Hesling for reporting the bug and identifying the commit of the fix (Closes: #1116278). * Update the Maintainer field, because Adam Borowski is no longer maintaining this package in Debian. -- Nicholas D Steeves Fri, 31 Oct 2025 15:16:11 -0400 --- Cambios de chrony --- chrony (4.3-2+deb12u3) bookworm; urgency=medium * debian/chrony.if-{post-down,up}: - Adjust the if-up and if-down hook scripts so that they always exit successfully. (Closes: #1011533) -- Vincent Blut Thu, 02 Jul 2026 15:56:53 +0200 chrony (4.3-2+deb12u2) bookworm; urgency=medium * debian/patches/: - Add refclock_phc_open-device-for-writing-with-extpps-option.patch. Thanks to Jan Lübbe for the report. (Closes: #1127659) * debian/tests/upstream-simulation-test-suite: - Prevent simulation test failures. -- Vincent Blut Tue, 17 Feb 2026 16:40:15 +0100 --- Cambios de clamav (clamav-base clamav-daemon clamav-freshclam clamdscan libclamav12) --- clamav (1.4.3+dfsg-1~deb12u2) bookworm; urgency=medium * Revert moving files to usr/lib -- Sebastian Andrzej Siewior Wed, 07 Jan 2026 21:19:45 +0100 clamav (1.4.3+dfsg-1~deb12u1) bookworm; urgency=medium * Import 1.4.3 - CVE-2025-20234 (Fixed a possible buffer overflow read bug in the UDF file parser that may write to a temp file and thus disclose information, or it may crash and cause a denial-of-service (DoS) condition.) Closes: #1108045 * Move files from lib to usr/lib (Closes: #1073612). * Mark clamav-base as foreign (Closes: #1060889). * Add libclamav12 after so bump. * Move documentation to clamav-doc. -- Sebastian Andrzej Siewior Sun, 21 Dec 2025 17:37:50 +0100 --- Cambios de curl (libcurl3-gnutls libcurl4) --- curl (7.88.1-10+deb12u15) bookworm; urgency=medium * Fix 7 CVEs: - CVE-2025-10148 - CVE-2025-14524 - CVE-2025-14819 - CVE-2026-3783 - CVE-2026-3784 - CVE-2026-5773 - CVE-2026-7168 -- Samuel Henrique Fri, 08 May 2026 07:16:21 -0700 --- Cambios de distro-info-data --- distro-info-data (0.58+deb12u7) bookworm; urgency=medium * Add Ubuntu 26.10 "Stonking Stingray" (LP: #2150234). -- Stefano Rivera Sat, 25 Apr 2026 09:18:53 -0400 distro-info-data (0.58+deb12u6) bookworm; urgency=medium * Update data to 0.68: - Update the bookworm EoL - Add Ubuntu 26.04 LTS "Resolute Raccoon" (LP: #2126961) -- Stefano Rivera Sat, 18 Oct 2025 16:50:26 +0200 --- Cambios de dpkg --- dpkg (1.21.23) bookworm; urgency=medium [ Guillem Jover ] * dpkg-deb: Fix cleanup for control member with restricted directories. Reported by zhutyra on HackerOne. Fixes CVE-2025-6297. * Perl modules: - Dpkg::BuildDriver::DebianRules: Fix uninitialized Perl variables. Closes: #1107971 - Dpkg::BuildDriver::DebianRules: Fix R³ dpkg/target/ values handling. * Code internals: - libdpkg: Fix varbuf memory leak in pkg_source_version(). - dpkg-deb: Initialize threads_max in no-uniform-compression mode. - libdpkg: Handle tar long GNU names and links not being NUL terminated. Closes: #1061404 - libdpkg: Do not segfault when adding triggers in no-act mode. Closes: #1108192 - libdpkg: Terminate zstd decompression when we have no more data. Reported by Yashashree Gund . Closes: #1129722 Fixes CVE-2026-2219. * Build system: - Build gitlab CI images for bookworm instead of sid. * Localization: - Fix typos in Swedish man pages translations. Closes: #1065575 - Update Swedish translations. Thanks to Peter Krefting . Closes: #1070010 [ Helge Kreutzmann ] * Localization: - Update German man pages translation. -- Guillem Jover Sat, 07 Mar 2026 13:15:41 +0100 --- Cambios de glib2.0 (libglib2.0-0) --- glib2.0 (2.74.6-2+deb12u9) bookworm; urgency=medium * Non-maintainer upload by the LTS Security Team. * Add patch to fix timezone handling with Debian & Ubuntu's symlinks (Closes: #1119919) (LP: #2130378) * CVE-2026-0988: Missing input validation in g_buffered_input_stream_peek (Closes: #1125752) * CVE-2026-1484: Integer overflow in base64 encoding can cause memory corruption. (Closes: #1126551) * CVE-2026-1485: Buffer underflow vulnerability in content type parsing caused by (signed) integer wrap for large inputs. (Closes: #1126550) * CVE-2026-1489: Integer overflow in unicode conversion can lead to memory corruption. (Closes: #1126549) -- Andreas Henriksson Fri, 13 Feb 2026 12:35:33 +0100 glib2.0 (2.74.6-2+deb12u8) bookworm; urgency=medium * Team upload. * CVE-2025-13601: integer overflow into heap buffer overflow escaping very large strings in g_escape_uri_string (Closes: #1121488). * CVE-2025-14087: buffer overwrite when processing large GVariant strings. (Closes: #1122347). * CVE-2025-14512: interger overflow into buffer overwrite when processing file attributes in GIO's escape_byte_string (Closes: #1122346). -- Emilio Pozuelo Monfort Mon, 15 Dec 2025 15:29:38 +0100 --- Cambios de glibc (libc6 libc-bin libc-l10n locales) --- glibc (2.36-9+deb12u14) bookworm; urgency=medium * debian/patches/git-updates.diff: update from upstream stable branch: - Fix a performance bottleneck with the Address Sanitizer (ASAN) on 32-bit arm. - Fix _dl_find_object when ld.so has LOAD segment gaps, causing wrong backtrace unwinding. This affects at least arm64. - Add GLIBC_ABI_DT_X86_64_PLT symbol version on amd64. - Fix typo in wmemset ifunc selector that caused AVX2/AVX512 paths to be skipped. - Fix POWER optimized rawmemchr function on ppc64el. - Optimize trylock for high cache contention workloads. - Fix and integer overflow in _int_memalign leading to heap corruption (CVE-2026-0861). Closes: #1125678. - Fix stack contents leak in getnetbyaddr (CVE-2026-0915). Closes: #1125748. - Fix bug in wordexp, which could return uninitialized memory when using WRDE_REUSE together with WRDE_APPEND (CVE-2025-15281). Closes: #1126266. - Fix invalid pointer arithmetic in ANSI_X3.110 iconv module - Fix a typo preventing new tst-wordexp-reuse-mem to run - Fix incorrect handling of DNS responses in gethostbyaddr and gethostbyaddr_r (CVE-2026-4437). Closes: #1131435. - Fix invalid DNS hostnames returned by gethostbyaddr and gethostbyaddr_r (CVE-2026-4438). Closes: #1131887. - Fix random failure of tst-link-map-contiguous-ldso. - Fix a possible crash due to an assertion failure when converting inputs from the IBM139x character sets (CVE-2026-4046). Closes: #1132499. * d/p/amd64/local-revert-x86-64-add-GLIBC_ABI_DT_X86_64_PLT-version.diff: revert addition of the GLIBC_ABI_DT_X86_64_PLT symbol version used as ABI flag, as the dpkg-shlibdeps version in bookworm is not able to handle it (see #1122107). -- Aurelien Jarno Mon, 27 Apr 2026 22:14:33 +0200 --- Cambios de graphite2 (libgraphite2-3) --- graphite2 (1.3.14-1+deb12u1) bookworm; urgency=medium * debian/patches/ad78c6b7319909e1540c1b134e115ced03417866.patch: fix CVE-2026-50593 -- Rene Engelhard Sat, 06 Jun 2026 19:58:37 +0200 --- Cambios de grub2 (grub2-common grub-common grub-pc grub-pc-bin) --- grub2 (2.06-13+deb12u2) bookworm; urgency=medium [ Julian Andres Klode ] * Set Protected: yes for -signed packages so they cannot easily be removed * debian/patches: Backport to bookworm [ Felix Zielcke ] * Add salsa-ci.yml and disable blhc and reprotest pipelines. [ Luca Boccassi ] * salsa-ci: configure for stable builds [ Mate Kukri ] * Cherry-pick remaining XFS delta from 2.12 * Cherry-pick upstream vulnerability fixes * Cherry-pick extfs regression patch * Cherry-pick xfs regression patches * Bump SBAT level to grub,5 * fs/fat: Don't error when mtime is 0 (LP: #2098641) * SECURITY UPDATE: video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG - CVE-2024-45774 * SECURITY UPDATE: commands/extcmd: Missing check for failed allocation - CVE-2024-45775 * SECURITY UPDATE: gettext: Integer overflow leads to heap OOB write or read - CVE-2024-45776 * SECURITY UPDATE: gettext: Integer overflow leads to heap OOB write - CVE-2024-45777 * SECURITY UPDATE: fs/bfs: Integer overflow - CVE-2024-45778 * SECURITY UPDATE: fs/bfs: integer overflow leads to heap OOB read - CVE-2024-45779 * SECURITY UPDATE: fs/tar: Integer overflow leads to heap OOB write - CVE-2024-45780 * SECURITY UPDATE: fs/ufs: `strcpy` use leading to heap OOB write - CVE-2024-45781 * SECURITY UPDATE: fs/hfs: `strcpy` use leading to potential heap OOB write - CVE-2024-45782 * SECURITY UPDATE: fs/hfsplus: incorrect refcount handling leading to UAF - CVE-2024-45783 * SECURITY UPDATE: command/gpg: Use-after-free due to hooks not being removed on module unload - CVE-2025-0622 * SECURITY UPDATE: net: Out-of-bounds write in grub_net_search_config_file() - CVE-2025-0624 * SECURITY UPDATE: UFS: Integer overflow may lead to heap based out-of-bounds write when handling symlinks - CVE-2025-0677 * SECURITY UPDATE: squash4: Integer overflow may lead to heap based out-of-bounds write when reading data - CVE-2025-0678 * SECURITY UPDATE: reiserfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data - CVE-2025-0684 * SECURITY UPDATE: jfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data - CVE-2025-0685 * SECURITY UPDATE: romfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data - CVE-2025-0686 * SECURITY UPDATE: udf: Heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution - CVE-2025-0689 * SECURITY UPDATE: read: Integer overflow may lead to out-of-bounds write - CVE-2025-0690 * SECURITY UPDATE: commands/dump: The dump command is not in lockdown when secure boot is enabled - CVE-2025-1118 * SECURITY UPDATE: fs/hfs: Integer overflow may lead to heap based out-of-bounds write - CVE-2025-1125 * SECURITY UPDATE: insmod: incorrect refcount handling leading to UAF [LP: #2055835] [ Steve McIntyre ] * Drop NTFS patches that seem to be causing regressions * Remove NTFS from the monolithic EFI grub image, so we don't sign vulnerable code. * Similarly, remove jfs - we have doubts. * Bump SBAT levels: + grub,5 now we have the 2025 CVE fixes included + grub.debian,5 + grub.debian12,1 -- Steve McIntyre <93sam@debian.org> Wed, 01 Apr 2026 21:03:46 +0100 --- Cambios de libbytes-random-secure-perl --- libbytes-random-secure-perl (0.29-4~deb13u1~deb12u1) bookworm; urgency=medium * Rebuild for bookworm -- Salvatore Bonaccorso Fri, 26 Jun 2026 20:35:55 +0200 libbytes-random-secure-perl (0.29-4~deb13u1) trixie; urgency=medium * Rebuild for trixie -- Salvatore Bonaccorso Fri, 26 Jun 2026 20:32:02 +0200 libbytes-random-secure-perl (0.29-4) unstable; urgency=medium * Team upload. * Fix incorrect usage of seed in PRNG (CVE-2026-11625) -- Salvatore Bonaccorso Fri, 26 Jun 2026 17:27:21 +0200 --- Cambios de libcap2 (libcap2 libcap2-bin) --- libcap2 (1:2.66-4+deb12u3) bookworm; urgency=medium * Add patch fixing CVE-2026-4878 (TOCTOU race condition) -- Christian Kastner Mon, 06 Apr 2026 22:27:39 +0200 --- Cambios de libhtml-parser-perl --- libhtml-parser-perl (3.81-1+deb12u1) bookworm; urgency=medium * Fix heap-use-after-free in _decode_entities (CVE-2026-8829) -- Salvatore Bonaccorso Sat, 13 Jun 2026 16:54:34 +0200 --- Cambios de libxml-libxml-perl --- libxml-libxml-perl (2.0207+dfsg+really+2.0134-1+deb12u1) bookworm; urgency=medium * Team upload. * fix: replace domParseChar with xmlValidateName to prevent OOB UTF-8 read (CVE-2026-8177) (Closes: #1136300) -- Salvatore Bonaccorso Sat, 27 Jun 2026 13:41:54 +0200 --- Cambios de libxslt (libxslt1.1) --- libxslt (1.1.35-1+deb12u4) bookworm; urgency=medium * Non-maintainer upload. * Fix deterministic generate-id() regression introduced in previous fix by moving the stable ID generation into a per-transform, per-document hash table. (Closes: #1114928) -- Miao Wang Fri, 10 Apr 2026 06:56:30 +0000 --- Cambios de openmediavault --- openmediavault (7.7.24-7) stable; urgency=medium * Several improvements. * Add omv-release-upgrade to allow users to migrate their systems to OMV8 (Synchrony) which is based on Debian 13 (Trixie). -- Volker Theile Sun, 07 Dec 2025 08:08:40 +0100 openmediavault (7.7.23-1) stable; urgency=medium * Improve performance when enumerating file systems. * Issue #2055: Add SMART support for QNAP TR-004U (non-RAID mode). -- Volker Theile Mon, 24 Nov 2025 21:13:47 +0100 openmediavault (7.7.22-1) stable; urgency=medium * Fix NFS configuration issue when `insecure` option is used in a share. -- Volker Theile Sun, 16 Nov 2025 10:54:32 +0100 openmediavault (7.7.21-1) stable; urgency=medium * Hardening the log file parser. -- Volker Theile Fri, 07 Nov 2025 09:29:18 +0100 openmediavault (7.7.20-1) stable; urgency=medium * Update locale files. * Improve the temperature detection via SMART. Thanks to robNice. * Fix bug in configuring APM/AAM/spindown for disk. -- Volker Theile Sun, 26 Oct 2025 01:55:43 +0200 openmediavault (7.7.19-2) stable; urgency=medium * Update locale files. * Several improvements, e.g. missing translations in the Workbench UI. * Issue #2012: Fix resizing issue of Dashboard chart widgets. -- Volker Theile Wed, 01 Oct 2025 20:40:41 +0200 --- Cambios de openssh (openssh-client openssh-server openssh-sftp-server) --- openssh (1:9.2p1-2+deb12u10) bookworm; urgency=medium * Backport minor security fixes from 10.3p1: - ssh(1): the -J and equivalent -oProxyJump="..." options now validate user and host names for ProxyJump/-J options passed via the command-line (no such validation is performed for this option in configuration files). This prevents shell injection in situations where these were directly exposed to adversarial input, which would have been a terrible idea to begin with. - CVE-2026-35386: ssh(1): validation of shell metacharacters in user names supplied on the command-line was performed too late to prevent some situations where they could be expanded from %-tokens in ssh_config. For certain configurations, such as those that use a "%u" token in a "Match exec" block, an attacker who can control the user name passed to ssh(1) could potentially execute arbitrary shell commands. Reported by Florian Kohnhäuser (closes: #1132573). We continue to recommend against directly exposing ssh(1) and other tools' command-lines to untrusted input. Mitigations such as this can not be absolute given the variety of shells and user configurations in use. - CVE-2026-35414: sshd(8): when matching an authorized_keys principals="" option against a list of principals in a certificate, an incorrect algorithm was used that could allow inappropriate matching in cases where a principal name in the certificate contains a comma character. Exploitation of the condition requires an authorized_keys principals="" option that lists more than one principal *and* a CA that will issue a certificate that encodes more than one of these principal names separated by a comma (typical CAs strongly constrain which principal names they will place in a certificate). This condition only applies to user- trusted CA keys in authorized_keys, the main certificate authentication path (TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected. Reported by Vladimir Tokarev (closes: #1132576). - CVE-2026-35385: scp(1): when downloading files as root in legacy (-O) mode and without the -p (preserve modes) flag set, scp did not clear setuid/setgid bits from downloaded files as one might typically expect. This bug dates back to the original Berkeley rcp program. Reported by Christos Papakonstantinou of Cantina and Spearbit (closes: #1132572). - CVE-2026-35387: sshd(8): fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys. Previously if one of these directives contains any ECDSA algorithm name (say "ecdsa-sha2-nistp384"), then any other ECDSA algorithm would be accepted in its place regardless of whether it was listed or not. Reported by Christos Papakonstantinou of Cantina and Spearbit (closes: #1132574). - CVE-2026-35388: ssh(1): connection multiplexing confirmation (requested using "ControlMaster ask/autoask") was not being tested for proxy mode multiplexing sessions (i.e. "ssh -O proxy ..."). Reported by Michalis Vasileiadis (closes: #1132575). -- Colin Watson Tue, 05 May 2026 11:26:56 +0100 --- Cambios de pam (libpam0g libpam-modules libpam-modules-bin libpam-runtime) --- pam (1.5.2-6+deb12u2) bookworm; urgency=medium * Fix CVE-2025-6020: local privilege escalation in pam_namespace, Closes: #1107919 * Check for explicit_bzero and memset_explicit so pam_namespace can use them -- Sam Hartman Sun, 10 Aug 2025 09:54:02 -0600 --- Cambios de python-xmltodict (python3-xmltodict) --- python-xmltodict (0.13.0-1.1~deb12u1) bookworm; urgency=medium * Non-maintainer upload. * Rebuild for bookworm. -- Adrian Bunk Fri, 03 Jul 2026 17:45:21 +0300 python-xmltodict (0.13.0-1.1) unstable; urgency=medium * Non-maintainer upload. * CVE-2025-9375: XML Injection (Closes: #1113825) -- Adrian Bunk Sun, 28 Jun 2026 20:26:05 +0300 --- Cambios de python3.11 (libpython3.11 libpython3.11-minimal libpython3.11-stdlib python3.11 python3.11-minimal) --- python3.11 (3.11.2-6+deb12u8) bookworm; urgency=medium * Non-maintainer upload. * Apply upstream patches for the following CVEs: - CVE-2025-13462: Incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined - CVE-2026-2297: SourcelessFileLoader does not use io.open_code() - CVE-2026-3644: Reject control characters in more places in http.cookies.Morsel (follow-up of patch for CVE-2026-0672) - CVE-2026-4224: pyexpat.c: Unbounded C recursion in conv_content_model causes crash - CVE-2026-4519: Reject leading dashes in webbrowser.open() - CVE-2026-6100: Possible UAF in {LZMA,BZ2}Decompressor * Add patch to skip some failing XML tests. Failure is due to the fact that we build / tests against expat/2.5.0-1+deb12u2, which was patched for CVE-2023-52425, and that broke some tests. See the patch itself for more details. -- Arnaud Rebillout Tue, 12 May 2026 12:17:27 +0700 python3.11 (3.11.2-6+deb12u7) bookworm; urgency=medium * Non-maintainer upload. * Apply upstream patches for the following CVEs: - CVE-2025-4516: issue in bytes.decode("unicode_escape", error="ignore|replace") - CVE-2025-6069: quadratic complexity in html.parser.HTMLParser - CVE-2025-6075: performance degradation in os.path.expandvars() - CVE-2025-8194: infinite loop and deadlock in tarfile - CVE-2025-8291: incorrect ZIP64 End of Central Directory handling - CVE-2025-11468: Folding email comments of unfoldable characters didn't preserve parenthesis which could be abused. - CVE-2025-12084: quadratic complexity in xml.dom.minidom appendChild etc - CVE-2025-13836: OOM or other DoS due to incorrect Content-Length handling in http.client - CVE-2025-13837: OOM or other DoS due to incorrect data size handling in plistlib - CVE-2025-15282: User-controlled data URLs parsed by urllib allowed injecting headers through newlines in the data URL mediatype. - CVE-2026-0672: User-controlled cookie values and parameters could be used to inject HTTP headers into messages. - CVE-2026-0865: User-controlled header names and values containing newlines could be used to inject HTTP headers. - CVE-2026-1299: email module allowed header injection in the BytesGenerator class. -- Arnaud Rebillout Wed, 08 Apr 2026 08:58:00 +0700 --- Cambios de rsync --- rsync (3.2.7-1+deb12u6) bookworm; urgency=medium * Non-maintainer upload. * Import upstream patch to reject overlong HTTP proxy response lines, avoiding a one byte out of bounds stack write when using RSYNC_PROXY. (CVE-2026-45232). -- Aquila Macedo Costa Sun, 24 May 2026 18:23:41 -0300 --- Cambios de sed --- sed (4.9-1+deb12u1) bookworm; urgency=medium * Non-maintainer upload. * sed: -i --follow-symlinks: fix TOCTOU race (CVE-2026-5958) (Closes: #1134495) -- Salvatore Bonaccorso Tue, 21 Apr 2026 09:50:58 +0200 --- Cambios de shadow (login passwd) --- shadow (1:4.13+dfsg1-1+deb12u2) bookworm; urgency=medium * Apply upstream patch to fix groupmod -U "" segfault (Closes: #1122913) -- Chris Hofstaedtler Sun, 14 Dec 2025 15:00:01 +0100 --- Cambios de sudo --- sudo (1.9.13p3-1+deb12u4) bookworm; urgency=medium * cherry-pick upstream exec_mailer-Set-group-as-well-as-uid. This is adapted from upstream and fixes CVE-2026-35535: https://github.com/sudo-project/sudo/commit/3e474c2 (Closes: #1130593) -- Marc Haber Sat, 11 Apr 2026 14:01:23 +0200 sudo (1.9.13p3-1+deb12u3) bookworm; urgency=medium * Apply a patch fro Marcos Del Sol Vives to Enable Intel CET on amd64 only. This has been discussed with the TC in #1113774. After following their advice to apply the patch, I verified that this change produces an identical deb on amd64 (Closes: #1124339) -- Marc Haber Tue, 30 Dec 2025 21:07:33 +0100 --- Cambios de systemd (libnss-myhostname libnss-resolve libnss-systemd libsystemd0 libsystemd-shared libudev1 systemd systemd-resolved systemd-sysv udev) --- systemd (252.39-1~deb12u2) bookworm; urgency=medium [ Arnaud Rebillout ] * test-cgroup: Ignore ENOENT from cg_create() * CVE-2026-4105 (A flaw was found in systemd. The systemd-machined service contains an ...) * CVE-2026-29111 (systemd, a system and service manager, (as PID 1) hits an assert and f ...) * CVE-2026-40225 (In udev in systemd before 260, local root execution can occur via mali ...) * CVE-2026-40226 (In nspawn in systemd 233 through 259 before 260, an escape-to-host act ...) -- Tobias Deiminger Mon, 27 Apr 2026 21:48:55 +0200 --- Cambios de wireless-regdb --- wireless-regdb (2026.05.30-1~deb12u1) bookworm; urgency=medium * Rebuild for bookworm -- Ben Hutchings Fri, 05 Jun 2026 19:02:58 +0200 wireless-regdb (2026.05.30-1) unstable; urgency=medium * New upstream version: - Add regulatory info for CEPT countries FO, GI, IM, SM and VA listed by WiFi Alliance - Update 6 GHz rules for Hong Kong (HK) - Update 5/6 GHz power rules for Russia (RU) - Fix 60 GHz power unit for Ukraine (UA) - Update 6 GHz rules for South Africa (ZA) - Update 6 GHz rules for South Korea (KR) - allow 320MHz channel width for Russia - Update regulatory info for Brunei Darussalam (BN) for 2022 - Update regulatory rules for Sri Lanka (LK) -- Ben Hutchings Fri, 05 Jun 2026 17:45:04 +0200 wireless-regdb (2026.03.18-1) unstable; urgency=medium * New upstream version: - Update regulatory rules for India (IN) on 6GHz -- Ben Hutchings Thu, 07 May 2026 11:43:19 +0200 wireless-regdb (2026.02.04-1~deb12u1) bookworm; urgency=medium * Backport to bookworm: - Revert "d/salsa-ci.yml: Suppress false bad-distribution-in-changes-file error" which is no longer needed - Revert "Add support and documentation for setting default regulatory domain" - d/rules: Set FIRMWARE_PATH = /lib/firmware -- Ben Hutchings Fri, 20 Feb 2026 17:30:17 +0100 wireless-regdb (2026.02.04-1) unstable; urgency=medium [ Ben Hutchings ] * New upstream version: - Update regulatory info for Australia (AU) for 2025 - Update broken link in regulatory.bin(5) manpage - Update regulatory info for Malaysia (MY) for 2024 - Update regulatory info for Malaysia (MY) for 2025 - Update regulatory info for Tunisia (TN) on 6GHz for 2025 - Update regulatory info for Canada (CA) for 2025 * d/rules: Install regulatory.db under /usr without dh_movetousr (Closes: #1122785) * d/README.Debian: Remove minimum kernel version for direct-loading * Add support and documentation for setting default regulatory domain [ Bastian Germann ] * Drop unnecessary B-D m2crypto (Closes: #1126431) -- Ben Hutchings Fri, 13 Feb 2026 14:11:18 +0100 wireless-regdb (2025.10.07-1) unstable; urgency=medium * New upstream version: - update regulatory rules for Botswana (BW) for 2022 - update regulatory rules for Sint Marteen (SX) for 2018 - Update regulatory info including bandwidth for Costa Rica (CR) for 2023 - Permit lower 6 GHz band for Kazakhstan (KZ) * d/salsa-ci.yml: Remove obsolete lintian error suppression * d/upstream/signing-key.asc: Update for later expiry date * d/watch: Convert to version 5 format -- Ben Hutchings Mon, 20 Oct 2025 20:42:25 +0200 --- Binary NMU of: bash (5.2.15-2+b13), busybox (1:1.35.0-4+deb12u1+b1), libcap2 (1:2.66-4+deb12u3+b1) * Binary-only non-maintainer upload for amd64; no source changes. * Rebuild for outdated Built-Using (glibc/2.36-9+deb12u13) ======================================================================== You can perform the upgrade by issuing the command: apt-get dist-upgrade as r