[РЕШЕНО] Ошибка № ...

вторник

[Bug 1786013] Autopkgtest regression report (linux-restricted-modules-gcp-6.8/6.8.0-1071.79~22.04.1+1)

All autopkgtests for the newly accepted linux-restricted-modules-gcp-6.8 (6.8.0-1071.79~22.04.1+1) for jammy have finished running. The following regressions have been reported in tests triggered by the package: nvidia-graphics-drivers-470/470.256.02-0ubuntu0.22.04.6 (amd64) Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1]. https://ubuntu-archive-team.ubuntu.com/proposed- migration/jammy/update_excuses.html#linux-restricted-modules-gcp-6.8 [1] https://documentation.ubuntu.com/project/SRU/howto/autopkgtest- failure/ Thank you! -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/1786013 Title: Packaging resync Status in linux package in Ubuntu: Fix Released Status in linux-azure package in Ubuntu: Fix Released Status in linux-azure-edge package in Ubuntu: Fix Released Status in linux source package in Precise: Fix Released Status in linux-azure source package in Precise: Won't Fix Status in linux-azure-edge source package in Precise: Won't Fix Status in linux source package in Trusty: Fix Released Status in linux-azure source package in Trusty: Fix Released Status in linux-azure-edge source package in Trusty: Won't Fix Status in linux source package in Xenial: Fix Released Status in linux-azure source package in Xenial: Fix Released Status in linux-azure-edge source package in Xenial: Fix Released Status in linux source package in Bionic: Fix Released Status in linux-azure source package in Bionic: Fix Released Status in linux-azure-edge source package in Bionic: Fix Released Status in linux source package in Cosmic: Fix Released Status in linux-azure source package in Cosmic: Fix Released Status in linux-azure-edge source package in Cosmic: Won't Fix Status in linux source package in Disco: Fix Released Status in linux-azure source package in Disco: Fix Released Status in linux-azure-edge source package in Disco: Won't Fix Bug description: Ongoing packaging resyncs. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1786013/+subscriptions

[Bug 1786013] Autopkgtest regression report (linux-restricted-modules-gcp-6.8/6.8.0-1071.79~22.04.1+1)

[Bug 2172887] [NEW] Noble update: upstream stable patchset 2026-11-03

Public bug reported: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-11-03 Ported from the following upstream stable releases: v6.6.160, v6.12.114 from git://git.kernel.org/ xfrm: prevent policy_hthresh.work from racing with netns teardown Bluetooth: btqcomsmd: Convert to platform remove callback returning void ieee802154: cc2520: fix FIFOP work use-after-free openvswitch: prepare for stolen verdict coming from conntrack and nat engine perf/x86/intel: Update event constraints and cache_extra_regsfor ADL perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification scsi: lpfc: Define lpfc_dmabuf type for ctx_buf ptr net: add and use skb_get_hash_net usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41 drm/amd/display: Mark DCE 6.4 as not APU erofs: avoid infinite loops due to corrupted subpage compact indexes erofs: unify lcn as u64 for 32-bit platforms iio: adc: axp288: Add TS bias override for Haier HV103H HID: core: introduce hid_safe_input_report() HID: uhid: convert to hid_safe_input_report() netfilter: nft_set_pipapo: restore cloned mapping table memcg accounting pmdomain: rockchip: propagate subdomain add errors iio: light: Drop ROHM BU27034 UBUNTU: [Config] remove CONFIG_ROHM_BU27034 dlm: validate length in dlm_search_rsb_tree HID: steam: Clean up locking ip6_gre: remove obsolete ERSPAN PMTU update mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge ALSA: pcm: oss: Fix setup list UAF on proc write error ALSA: mixer: oss: Add card disconnect checkpoints net: team: rename team to team_core for linking net: team: Remove unused team_mode_op, port_enabled net: team: Rename port_disabled team mode op to port_tx_disabled net: team: fix NULL pointer dereference in team_xmit during mode change net: team: stop reusing skb after queue override Bluetooth: hci_sync: Fix command skb lifetime during scan setup Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex drm/vmwgfx: validate pitch coming from userspace namespace: don't inherit MNT_UMOUNT in clone_mnt() namespace: check the mounts before reading their parents in pivot_root() net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ scsi: ch: Do not keep references to data transfer element devices scsi: ufs: mcq: Remove unused parameters scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe() scsi: ufs: core: Add debug log for MCQ command timeout scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock() scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() drm/vc4: Fix firmware reference leak in vc4_drm_bind() namespace: unhash a dentry before detaching the mounts on it namespace: check the target before walking it in do_mount_setattr() fcntl: refuse F_SET_RW_HINT on an immutable inode namespace: handle mount locking for automounts correctly tty: add break_wait kernel-doc net: nexthop: Have all NH notifiers carry NH ID net: nexthop: Increase weight to u16 drm/amdgpu: change vm->task_info handling bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro() ice: Don't process extts if PTP is disabled ice: Fix improper extts handling gve: Account for stopped queues when reading NIC stats serial: sc16is7xx: fix TX fifo corruption scsi: lpfc: Fix failure to delete vports when discovery is in progress scsi: lpfc: Remove shost_lock protection for fc_host_port shost APIs scsi: lpfc: Change nlp state statistic counters into atomic_t scsi: lpfc: Protect vport fc_nodes list with an explicit spin lock scsi: lpfc: Change lpfc_vport fc_flag member into a bitmask l2tp: prevent possible tunnel refcount underflow fuse: Fix missing FOLL_PIN for direct-io udmabuf: change folios array from kmalloc to kvmalloc udmabuf: fix memory leak on last export_udmabuf() error path PCI: imx6: Fix suspend/resume support on i.MX6QDL RDMA/siw: Remove direct link to net_device mm: clear uffd-wp PTE/PMD state on mremap() btrfs: do proper folio cleanup when run_delalloc_nocow() failed btrfs: do proper folio cleanup when cow_file_range() failed ax25: Remove broken autobind RISC-V: KVM: Teardown riscv specific bits after kvm_exit wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info wifi: ath12k: fix incorrect TID updation in DP monitor status path wifi: ath12k: Avoid explicit type cast in monitor status parse handler wifi: ath12k: Avoid memory leak while enabling statistics perf: Fix hang while freeing sigtrap event smb: client: allocate crypto only for primary server smb: client: fix UAF in decryption with multichannel ublk: fix handling recovery & reissue in ublk_abort_queue() fs/ntfs3: Use function file_inode to get inode from file fs/ntfs3: Separete common code for file_read/write iter/splice fs/ntfs3: Keep write operations atomic drm/amd/display: prevent hang on link training fail kasan: avoid sleepable page allocation from atomic context clk: sunxi-ng: h616: Reparent CPU clock during frequency changes clk: sunxi-ng: h616: Reparent GPU clock during frequency changes dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn virtio: make virtio_bus const virtio: hookup irq_get_affinity callback virtio: break and reset virtio devices on device_shutdown() wifi: iwlwifi: don't warn when if there is a FW error coresight: holding cscfg_csdev_lock while removing cscfg from csdev riscv: save the SR_SUM status over switches s390/mm: Fix in_atomic() handling in do_secure_storage_access() drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() rv: Use strings in da monitors tracepoints wifi: iwlwifi: return ERR_PTR from opmode start() wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() net/sched: Fix backlog accounting in qdisc_dequeue_internal mm/smaps: fix race between smaps_hugetlb_range and migration crypto: x86/aegis128 - eliminate some indirect calls crypto: x86/aegis128 - optimize length block preparation using SSE4.1 crypto: x86/aegis128 - improve assembly function prototypes crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT crypto: x86/aegis - Add missing error checks ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog wifi: mt76: mt7915: fix list corruption after hardware restart mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() smb: client: let recv_done verify data_offset, data_length and remaining_data_length dm-verity: provide dma_alignment limit in io_hints dm-stripe: limit chunk_sectors to the stripe size iommu/s390: Make attach succeed when the device was surprise removed bpf: improve error message for unsupported helper bpf: add a get_helper_proto() utility function bpf: Check the helper function is valid in get_helper_proto RISC-V: KVM: Write hgatp register with valid mode bits tcp_metrics: use dst_dev_net_rcu() crypto: hisilicon/qm - request reserved interrupt for virtual function net: use dst_dev_rcu() in sk_setup_caps() ASoC: Intel: avs: Do not share the name pointer between components tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() mlx5: Fix default values in create CQ drm/amdgpu: fix gpu page fault after hibernation on PF passthrough scsi: ufs: qcom : Refactor phy_power_on/off calls scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) scsi: imm: Fix use-after-free bug caused by unfinished delayed work gfs2: Prevent recursive memory reclaim coresight: ETR: Fix ETR buffer use-after-free issue wifi: ath12k: Fix MSDU buffer types handling in RX error path scsi: qla2xxx: Clear cmds after chip reset Input: alps - fix use-after-free bugs caused by dev3_register_work Input: lkkbd - disable pending work before freeing device usb: gadget: Support already-mapped DMA SGs usb: gadget: functionfs: Factorize wait-for-endpoint code functionfs, gadgetfs: use simple_recursive_removal() functionfs: fix the open/removal races wifi: mac80211: don't WARN for connections on invalid channels PCI: endpoint: Add missing NULL check for alloc_workqueue() bpf: Mark bpf_refcount field as unique staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths of: unittest: Fix memory leak in unittest_data_add() ALSA: usb-audio: Prevent excessive number of frames tcp: secure_seq: add back ports to TS offset cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN fs: super_set_uuid() ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION drm/amdgpu: Remove usage of the deprecated ida_simple_xx() API drm/amdgpu: prevent immediate PASID reuse case cxl/port: Fix use after free of parent_port in cxl_detach_ep() ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() s390/mm: Add missing secure storage access fixups for donated memory KVM: SEV: Use long-term pin when registering encrypted memory regions KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock usb: gadget: f_hid: don't call cdev_init while cdev in use rxrpc: proc: size address buffers for %pISpc output net: lan966x: fix page pool leak in error paths Bluetooth: hci_event: move wake reason storage into validated event handlers bpf: Fix incorrect pruning due to atomic fetch precision tracking Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists mpls: add seqcount to protect the platform_label{,s} pair HID: core: Add reserved item tag for main items HID: rate-limit hid_warn to prevent log flooding HID: core: Mitigate potential OOB by removing bogus memset() ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() types: move struct rcuwait into types.h irqwork: Move data struct to a types header srcu: Use irq_work to start GP in tiny SRCU btrfs: tree-log: don't use token set/get accessors in fill_inode_item() btrfs: fix zero size inode with non-zero size after log replay fs/ntfs3: Accumulated refactoring changes ntfs3: fix circular locking dependency in run_unpack_ex wifi: iwlwifi: fix 22000 series SMEM parsing wifi: rtw89: pci: validate sequence number of TX release report team: avoid NETDEV_CHANGEMTU event when unregistering slave drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels drm/amdgpu: Skip vcn poison irq release on VF btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue i3c: mipi-i3c-hci: Fix race in DMA ring dequeue ASoC: amd: acp-mach-common: Add missing error check for clock acquisition net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ iommu/vt-d: Clear Present bit before tearing down PASID entry bpf: Fix tcx/netkit detach permissions when prog fd isn't given btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation net: stmmac: fix oops when split header is enabled gfs2: fix memory leaks in gfs2_fill_super error path KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 dm-verity-fec: fix reading parity bytes split across blocks (take 3) spi: microchip-core-qspi: control built-in cs manually riscv: kvm: fix vector context allocation leak f2fs: fix fsck inconsistency caused by FGGC of node block RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() spi: mpc52xx: fix controller deregistration drm/amd/display: Fix dc_link NULL handling in HPD init coresight: tmc-etr: Fix race condition between sysfs and perf mode selinux: allow multiple opens of /sys/fs/selinux/policy netfilter: nf_tables: use list_del_rcu for netlink hooks Revert "net/smc: Introduce TCP ULP support" tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() sched/psi: fix race between file release and pressure write netfilter: nat: use kfree_rcu to release ops ice: fix double-free of tx_buf skb f2fs: fix data loss caused by incorrect use of nat_entry flag f2fs: avoid reading already updated pages during GC greybus: raw: fix use-after-free on cdev close iommu/amd: Fix clone_alias() to use the original device's devid net: pull headers in qdisc_pkt_len_segs_init() powerpc/64s: Fix unmap race with PMD migration entries powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy vdpa: use generic driver_override infrastructure PCI: use generic driver_override infrastructure fs/mbcache: cancel shrink work before destroying the cache staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction Staging: rtl8723bs: Remove dead code from _rtw_free_network() Staging: rtl8723bs: Delete dead code from update_current_network() staging: rtl8723bs: clean up redundant & parentheses staging: rtl8723bs: fix buffer over-read in rtw_update_protection wifi: fix leak if split 6 GHz scanning fails l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() btrfs: only release the dirty pages io tree after successful writes net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind net: mana: Guard mana_remove against double invocation wifi: mt76: mt7921: Place upper limit on station AID drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() drm/msm: always recover the gpu fbdev: omap2: fix inconsistent lock returns in omapfb_mmap fbdev: omap2: fix use-after-free in omapfb_mmap f2fs: read COW data with the original inode during atomic write gcov: use atomic counter updates to fix concurrent access crashes drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring drm/amdgpu: fix amdgpu_hmm_range_get_pages usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close net/handshake: Drain pending requests at net namespace exit ethtool: rss: fix indir_table and hkey leak on get_rxfh failure cgroup/rstat: validate cpu before css_rstat_cpu() access hwmon: (lm90) Stop work before releasing hwmon device netfilter: bridge: eb_tables: close module init race netfilter: ebtables: move to two-stage removal scheme mm/util: Introduce kmemdup_array() netfilter: Use kmemdup_array instead of kmemdup for multiple allocation netfilter: x_tables: allow initial table replace without emitting audit log message netfilter: x_tables: allocate hook ops while under mutex wifi: mac80211: fix missing RX bitrate update for mesh forwarding path wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb erofs: fix metabuf leak in inode xattr initialization drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() hwmon: (lm90) Add lock protection to lm90_alert smb/client: fix chown/chgrp with SMB3 POSIX Extensions ksmbd: validate NTLMv2 response before updating session key ksmbd: prevent path traversal bypass by restricting caseless retry ALSA: hda/cs35l41: Fix firmware load work teardown net/handshake: Take a long-lived file reference at submit KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state LoongArch: Move jump_label_init() before parse_early_param() drm/vc4: Shut down BO cache timer before teardown drm/amdgpu: Use dbg level for VBIOS check messages drm/amdgpu: Add wrapper for freeing vbios memory drm/amdgpu: Release VFCT ACPI table reference drm/i915/mst: limit DP MST ESI service loop drm/i915/gt: Fix NULL deref on sched_engine alloc failure drm/amdkfd: Check bounds on CRIU restore queue type and mqd size cifs: prevent readdir from changing file size due to stale directory metadata cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths tipc: serialize udp bearer replicast list updates firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() wifi: cfg80211: use wiphy work for socket owner autodisconnect wifi: mac80211: refactor populating mesh related fields in sinfo wifi: cfg80211: add link_station_info structure to support MLO statistics wifi: mac80211: defer link RX stats percpu free to RCU RDMA/irdma: Prevent user-triggered null deref on QP create xfrm: fix stale skb->prev after async crypto steals a GSO segment LoongArch: Fix address space mismatch in kexec command line lookup net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains ovl: check access to copy_file_range source with src mounter creds s390/zcrypt: Fix buffer over-read in cca_cipher2protkey wifi: ieee80211: validate MLE common info length mmc: vub300: fix use-after-free on probe failure dm-verity: fix buffer overflow in FEC calculation ocfs2: correct l_next_free_rec in online check ocfs2: add suballoc slot check in ocfs2_validate_inode_block() ocfs2: validate i_refcount_loc when refcount flag is set ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec fs: Remove NTFS classic UBUNTU: [Config] remove classic NTFS options KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() net/liquidio: drop cached VF pci_dev LUT Bluetooth: 6lowpan: avoid untracked enable work net/mlx5e: Fix publication race for priv->channel_stats[] afs: Fix reinitialisation of the inode, in particular ->lock_work xen/pvcalls: bound backend response req_id before indexing rsp[] sctp: fix addr_wq_timer race in sctp_free_addr_wq() hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() sctp: add INIT verification after cookie unpacking tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() bpf: net: netfilter: drop dead NULL checks bpf: Guard conntrack opts error writes md/raid10: fix writes_pending leak on write request failures md/raid1: fix writes_pending and barrier reference leaks on write failures soundwire: fix bug in sdw_add_element_group_count found by syzkaller RDMA/irdma: Replace waitqueue and flag with completion RDMA/bnxt_re: Avoid repeated requests to allocate WC pages RDMA/bnxt_re: Initialize dpi variable to zero sockmap: Fix use-after-free in udp_bpf_recvmsg() ALSA: seq: fifo: Use guard() for locking ALSA: seq: Clean up fifo locking with guard ALSA: seq: avoid stale FIFO cells during resize net: watchdog: fix refcount tracking races bnxt: fix head underflow on XDP head-grow cxl/region: Block region delete during region creation ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT ixgbe: do not configure xps for XDP queues bpf: Reject sleepable BPF_LSM_CGROUP programs at load time bpf: Clear rb node linkage when freeing bpf_rb_root ocfs2: add extra consistency checks for chain allocator dinodes ocfs2: validate fast symlink target during inode read vhost: correct misleading printing information vhost: move smp_rmb() into vhost_get_avail_idx() wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() md/raid1,raid10: fix deadlock in read error recovery path ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data OPP: Fix race between OPP addition and lookup wifi: ath11k: cancel SSR work items during PCI shutdown s390/zcrypt: Close speculative mem read possibility octeontx2-af: Block VFs from clobbering special CGX PKIND state Bluetooth: ISO: hold sk properly in iso_conn_ready net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx btrfs: skip global block reserve accounting for rescue mounts mm/page_table_check: skip special zero mappings eventfs: Use children field for rcu head and add memory barriers selftests: tls: add test with a partially invalid iov selftests: tls: add rekey tests tls: rx: restore msg_iter before TLS 1.3 optimistic retry watchdog: at91sam9_wdt: prevent timer rearm during teardown s390/ism: Fix UAF of sba and ieq during ism_dev_exit() netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() hwmon: (pmbus) Fix type confusion in notification logic vhost_iotlb: bound map allocation in add_range bpf: Fix netns reference imbalance in conntrack kfuncs btrfs: lzo: reject inline extents without valid headers soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock firewire: ohci: fix NULL pointer dereference in ar_context_release ipvs: revalidate ihl to prevent out-of-bounds access sctp: validate cookie AUTH state before use scsi: core: pair EH runtime PM get and put tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() coresight: ete: Always save state on power down ALSA: seq: oss: Serialize readq reset state with q->lock btrfs: lzo: reject compressed segment that overflows the compressed input netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag EDAC/igen6: Fix call trace due to missing release() scsi: hisi_sas: Add slave_destroy interface for v3 hw cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size netfilter: nf_conntrack_expect: use conntrack GC to reap expectations Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks dmaengine: idxd: fix double free of wq, engine, and group structs bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length drm/amdkfd: Add bounds check for CRAT subtype length Bluetooth: ISO: zero the sockaddr before returning it in getname fbdev: Wrap user-invoked calls to fb_set_var() in helper RDMA/rxe: Remove redundant scheduling of rxe_completer RDMA/rxe: Merge request and complete tasks tipc: avoid busy looping in tipc_exit_net() NTB: core: Add .get_dma_dev() callback to ntb_dev_ops NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers ntb: Store original DMA address for future release tap: Keep hdr_len in tap_get_user() net: tap: fix wrong transport_header when sending VLAN-tagged frame io_uring: defer eventfd signaling when queued from a wakeup handler wifi: iwlwifi: dvm: pair transport op-mode enter/leave wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() power: supply: lp8788: Use devm_power_supply_register() helper filelock: split common fields into struct file_lock_core lockd: adapt to breakup of struct file_lock svcrdma: Refactor the creation of listener CMA ID sunrpc: xprtrdma: Use ERR_CAST() to return svcrdma: Reject Read lists that exceed the page budget svcrdma: Handle ADDR_CHANGE CM event properly SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 ext2: Fix lost inode updates for IS_SYNC inodes smb: client: reject a tree connect response whose byte count is too small smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() cifs: call pagecache_isize_extended() in cifs_setsize() when extending ceph: cap delegated inode count in ceph_parse_deleg_inos() ceph: fix UAF in check_new_map() on session freed during unlock nfsd: fix stale s2s_cp_stateids IDR entry for async COPY nfsd: split sc_status out of sc_type lockd, nfsd: RCU-protect nlmsvc_ops dispatch nfsd: Pass 'cred' instead of 'rqstp' to some functions. mm/mglru: fix and remove redundant unevictable folio handling ksmbd: fix uninitialized symbol 'share' in smb2_tree_connect() ksmbd: fix tree connection use-after-free in smb2_tree_connect() drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram drm/amdkfd: Fix error path at svm_migrate_copy_to_ram drm/amdkfd: Add TLB flush after MES queue eviction/suspension drm/amdgpu: force complete the KIQ ring fences on reset f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() LoongArch: BPF: Refactor jump offset calculation in tail call KVM: s390: Fix memory corruption by not reinjecting CK machine checks mm/huge_memory: transfer the pmd dirty bit to the folio on zap netfilter: nf_tables: skip double clone set expressions on element insert net/sched: act_ife: Only operate on Ethernet frames octeontx2-vf: fix workqueue and netdev race in probe/remove Bluetooth: do not leak an hci_conn when a second LE connect is rejected Bluetooth: L2CAP: access chan->conn safely in get/setsockopt Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition net/sched: account classifier filter allocations to memcg NFSv4.1: zero referring call lists before decoding vxlan: fix reading neigh ha net: bridge: arp/nd proxy: fix reading neigh ha ip6mr: do not clone dst in ip6mr_cache_report() ALSA: mtpav: shut down output timer before card teardown filelock: add some new helper functions NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers ksmbd: scope session state changes to bound connections ksmbd: detach blocked lock requests before freeing ksmbd: safely discard unregistered deferred locks erofs: fix interlaced ztailpacking pclusters ksmbd: defer publishing granted locks to prevent UAF/double-free race ksmbd: serialize oplock close with pending break ownership ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() apparmor: fix deadlock in complain-mode change_hat blk-cgroup: delay freeing policy data after rcu grace period blk-iocost: clear delay state when freeing policy data blk-iolatency: clear delay state when freeing policy data ocfs2: validate DIO orphan slot during inode read ocfs2: validate orphan slot during inode read nvmet: fix max_qid race between configfs and controller allocation clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type amt: Don't support cross-netns setup. NFS: Return a delegation the client fails to record bpf: Fix mmap_lock leak in irq_work path Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() btrfs: check if root is readonly when setting posix acl btrfs: always wait for ordered extents to avoid OE races btrfs: defrag: fix deadlock between defrag and delalloc space reservation scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable drm/amd/display: Resize MST HDCP per-connector arrays to 32 bpf: Clear buf on error in __bpf_get_task_stack ocfs2/heartbeat: fix slot mapping rollback leaks on error paths ocfs2: o2hb: quiesce negotiate handlers and timeout work thermal: hwmon: Remove hwmon class device along with its parent ocfs2: validate inline xattrs during inode block validation ublk: check import_ubuf() return value blk-cgroup: fix race between policy activation and blkg destruction HID: steam: Reject short reads HID: logitech-hidpp: Fix FF device cleanup on init failure tty: skip cdev_del() when no cdev is registered serial: core: clear freed pointers on uart_register_driver() failure serial: core: do fallible allocations before the console can be registered wifi: cfg80211: stop PMSR before P2P and NAN teardown wifi: brcmfmac: fix P2P action frame handling without device vif wifi: nl80211: check link is beaconing for color change wifi: nl80211: clean up color-change beacon data on errors arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry wifi: mt76: cancel reset and rc work on device unregister wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER wifi: mt76: mt7915: allocate vif wcid in the same range as stations wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface() wifi: mt76: mt7915: unwind state on add_interface failure wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() PCI: Make pci_match_one_device() match on ID instead of device PCI: Fix dyn_id add TOCTOU PCI: Fix UAF when probe runs concurrent to dyn ID removal clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path scsi: ufs: core: Convert string descriptor format macros to enum scsi: ufs: core: Validate string descriptors pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip bpf: Fix WARNING in bpf_tracing_link_release ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() bpf: remove unused parameter in bpf_jit_binary_pack_finalize bpf: Zero queue and stack outputs on lock failure drm/sched: Use struct for drm_sched_init() params drm/msm: Only fini scheduler after successful init firmware: arm_scmi: Fix SCMI device destroy lifetimes RDMA/rvt: Return NULL after port allocation failure esp: do not unref managed frag pages in esp_ssg_unref() platform/x86: asus-wmi: fix resource leaks on probe failure usb: gadget: uac: validate rate list length before storing bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max platform/x86: lg-laptop: Fix LED resource handling platform/x86: dell-wmi-base: Fix handling of ultra performance key bpf: Reject writes through untrusted BTF pointers time/namespace: Validate nanosecond field in proc_timens_set_offset() bpf: Reject MEM_ALLOC BTF accesses past object bounds cgroup/cpuset: introduce cpuset-v1.c dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout drm/amd/display: Fix dangling pointer in CRTC reset function drm/amd/display: Fix dangling pointer in plane reset function i3c: master: Fix recursive locking during device registration mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() nfsd: convert nfsd_net boolean flags to unsigned long flags word ACPI: bus: Introduce acpi_bus_get_primary_device() powerpc/xive: add error return value to xive_smp_probe() powerpc/xive: propagate IPI init errors to prevent use-after-free remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 ksmbd: remove redundant DACL check in smb_check_perm_dacl ksmbd: fix maximum allowed access checks drm/amdkfd: fix SMI event cross-process information leak drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq wifi: iwlwifi: mvm: fix P2P-Device binding handling RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() virt: acrn: Fix irqfd use-after-free during eventfd shutdown driver core: Avoid warning when removing a device while its supplier is unbinding serial: 8250: invert serial8250_register_8250_port() CIR condition tty: serial: 8250: protect against NULL uart->port.dev in register drm/amdgpu: Remove unused amdgpu_i2c functions drm/amdgpu/atombios: drop empty function drm/amdgpu: rework i2c init and fini drm/amdgpu: Bound GPIO I2C table entry count from VBIOS pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction genirq/proc: Size interrupt directory names for 10-digit interrupt numbers bpf: Mark raw_tp arguments with PTR_MAYBE_NULL net: dsa: b53: do not enable EEE on bcm63xx ACPI: platform: Use acpi_bus_get_primary_device() drm/msm: Recover HW before retire hung submit ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS RDMA/efa: Fix use of completion ctx after free ASoC: qcom: q6asm: handle the responses after closing ASoC: qcom: q6asm: drop DSP responses for closed data streams media: hantro: Disable multicore support media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC hwrng: core - use RCU and work_struct to fix race condition KVM: SVM: Add missing save/restore handling of LBR MSRs ceph: fix num_ops off-by-one when crypto allocation fails greybus: raw: fix use-after-free if write is called after disconnect erofs: fix use-after-free on sbi->sync_decompress net/handshake: hand off the pinned file reference to accept_doit cxl/region: Resolve region deletion races md/raid1,raid10: fix bio accounting for split md cloned bios md/raid1,raid10: fix error-path detection with md_cloned_bio() iommu: Pass domain to remove_dev_pasid() op nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net ocfs2: validate external xattr entries when reading metadata fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid ALSA: usx2y: Use standard print API perf/x86/intel: Prevent drain_pebs() reentry net/mlx5e: Move representor vnic reporter to eswitch devlink port Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() vhost: invalidate vring access on IOTLB transitions vduse: validate virtqueue alignment virtio_ring: fix stale descriptor flags after a failed packed add iommu/amd: Do not reallocate GA log buffers on resume bpf: mark a NULL call argument precise bpf: Preserve inner map identity in callback frames bpf: Mark NULL kptr stores precise bpf: Don't infer non-NULL from a pointer with an unbounded offset nvme_core: scan namespaces asynchronously bpf: Mark syscall helpers as sleepable erofs: disable LZ4 rolling decompression for now net: plumb extack in __dev_change_net_namespace() net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). btrfs: zstd: fix lost wakeup when waiting for a workspace bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge ipv6: mcast: use rcu_assign_pointer() for __rcu list updates smb/client: invalidate fscache for fallocate range operations smb/client: fix stale page cache in insert/collapse range bpf: check_cond_jmp_op(): properly infer if register is null drm/gud: validate GUD_ROTATION_0 is present in supported rotations drm/virtio: use the DMA API for resource backing on Xen smb/server: fix tree connection leak in smb2_tree_connect() r8169: remove original workaround for RTL8125 broken rx issue ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 Revert "ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev()" Revert "mm/filemap: avoid buffered read/write race to read inconsistent data" xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock xfs: catch stale AGF/AGF metadata xfs: rearrange code in xfs_buf_item.c xfs: factor out stale buffer item completion xfs: fix unmount hang with unflushable inodes stuck in the AIL bpf, sockmap: Account for receive queue in FIONREAD without a verdict program ksmbd: fix heap out-of-bounds write in krb5_authenticate() KVM: x86: Use active memslots for the per-vCPU MMIO cache spi: mpc52xx: clean up interrupt handling iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() xfs: avoid dquot buffer pin deadlock drm/amd: Create a device link between APU display and XHCI devices ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands wifi: mt76: connac: tolerate inactive BSS deactivation drm/vmwgfx: Stop using dev_private to store driver data. net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop riscv: Use offset_in_page() in text patching functions riscv: patch: Avoid early phys_to_page() riscv: patch: fix handling of bpf-jit execmem addresses drm/vc4: Use video aperture helpers smb: client: improve compound padding in encryption smb: client: get rid of bounds check in SMB2_ioctl_init() smb: client: fix compound alignment with encryption drm/i915/display: support struct intel_atomic_state in to_intel_display() drm/i915/display: pass display to intel_crtc_for_pipe() drm/i915/vga: Convert VGA code to intel_display drm/i915/display: convert I915_STATE_WARN() to struct intel_display drm/i915/de: register wait function renames drm/i915: add generic __to_intel_display() drm/i915/display: accept either i915 or display for feature tests drm/i915/de: allow intel_display and drm_i915_private for de functions drm/i915/gmbus: convert to struct intel_display drm/i915/crt: convert to struct intel_display drm/i915: Grab intel_display from the encoder to avoid potential oopsies f2fs: quota: fix to avoid warning in dquot_writeback_dquots() perf/dwc_pcie: Add support for QCOM vendor devices perf/dwc_pcie: Qualify RAS DES VSEC Capability by Vendor, Revision perf/dwc_pcie: fix duplicate pci_dev devices ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd wifi: ath12k: convert struct ath12k_sta::update_wk to use struct wiphy_work wifi: ath12k: prepare vif data structure for MLO handling wifi: ath12k: Fix memory leak due to multiple rx_stats allocation mm: fix uprobe pte be overwritten when expanding vma riscv: Enable cbo.zero only when all harts support Zicboz riscv: Add support for per-thread envcfg CSR values s390/kvm: Remove kvm_arch_fault_in_page() s390/mm: Simplify get_fault_type() s390/mm: Get rid of fault type switch statements platform/x86/amd/pmf: Switch to platform_get_resource() and devm_ioremap_resource() platform/x86/amd: pmf: Use device managed allocations drm/rockchip: vop2: Consistently use dev_err_probe() drm/rockchip: vop2: Register the primary plane and overlay plane separately rv: Remove trailing whitespace from tracepoint string mm/mremap: fix WARN with uffd that has remap events disabled iommu/s390: handle IOAT registration based on domain iommu/s390: set appropriate IOTA region type drm/xe: Don't allow evicting of BOs in same VM in array of VM binds ASoC: Intel: avs: Use topology information for endpoint numbers sysfs: check visibility before changing group attribute ownership amd/amdkfd: enhance kfd process check in switch partition RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET net/mlx5: Store the global doorbell in mlx5_priv net/mlx5e: Prepare for using different CQ doorbells net: vxlan: prevent NULL deref in vxlan_xmit_one wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks accel/ivpu: Allow to import single buffer into multiple contexts accel/ivpu: Rework bind/unbind of imported buffers accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() accel/qaic: Add config structs for supported cards net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels idpf: fix error handling in the init_task on load riscv: trace: fix snapshot deadlock with sbi ecall bpf: Fix exception exit lock checking for subprogs drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register dm: limit swapping tables for devices with zone write plugs net: use synchronize_rcu_expedited in cleanup_net() net: Factorise setup_net() and cleanup_net(). net: Add ops_undo_single for module load/unload. net: Add ->exit_rtnl() hook to struct pernet_operations. wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit bnxt_en: set backing store type from query type xfs: remove bp->b_error check in xfs_attr3_root_inactive xfs: factor out xfs_attr3_node_entry_remove xfs: close crash window in attr dabtree inactivation drm/amd/display: Add a function for checking tmds mode drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 media: chips-media: wave5: Fix Null reference while testing fluster btrfs: remove 'reserved' argument from btrfs_pin_extent() md raid: fix hang when stopping arrays with metadata through dm-raid KVM: Rename symbols related to enabling virtualization hardware KVM: Export hardware virtualization enabling/disabling functions syscore: Pass context data to callbacks wifi: iwlwifi: mvm: don't send a 6E related command when not supported rxrpc: kdoc: Update function descriptions and add link from rxrpc.rst rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() nouveau/gsp: drop WARN_ON in ACPI probes KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" doc: Clarify use of slab constructors and SLAB_TYPESAFE_BY_RCU refcount: provide ops for cases when object's memory can be reused wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync wifi: mt76: Fix memory leak destroying device iommu/vt-d: Avoid NULL pointer dereference or refcount corruption drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED wifi: mt76: add wcid publish check in mt76_sta_add netfs: Fix leak of request in netfs_write_begin() error handling netfs: Fix zeropoint update where i_size > remote_i_size KVM: guest_memfd: Treat memslot binding offset+size as unsigned values KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) KVM: x86: Rename APIC base setters to better capture their relationship KVM: x86: Move update_cr8_intercept() to lapic.c KVM: x86: Unconditionally recompute CR8 intercept on PPR update media: stm32: dcmipp: use v4l2_subdev_is_streaming media: stm32: dcmipp: replace s_stream with enable/disable_streams media: stm32-dcmipp: Return queued buffers on start_streaming() failure idpf: fix max_vport related crash on allocation error during init LoongArch: BPF: Zero-extend signed ALU32 div/mod results bnxt_en: Handle partially initialized auxiliary devices drm/xe/guc: Keep scheduler timeline name alive Bluetooth: hci_sync: extend conn_hash lookup critical sections bpf: Disable migration when destroying sock storage bpf: Disable migration when cloning sock storage rcu: add rcu_read_lock_dont_migrate() bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() drm/amd/display: use kvzalloc to allocate struct dc drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size wifi: mac80211: validate extension-frame layout before RX ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD mmc: vub300: Use devm_mmc_alloc_host() helper mmc: vub300: fix use-after-free on disconnect mmc: vub300: rename probe error labels RDMA/bnxt_re: Free CQ toggle page after firmware teardown nvmet-tcp: check return value of nvmet_tcp_set_queue_sock s390/ap: Move response_type struct into ap_msg struct s390/ap/zcrypt: Rework AP message buffer allocation s390/ap: Introduce ap message buffer pool s390/ap/zcrypt: New xflag parameter s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code s390/zcrypt: Rework domain processing within zcrypt device driver afs: Fix UAF when sending a message Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback Bluetooth: ISO: lock sk in iso_connect_ind xsk: drain continuation descs after overflow in xsk_build_skb() xsk: provide sufficient space in pool->tx_descs xsk: reclaim invalid Tx descriptors in ZC batch path net: ibm: emac: use devm_platform_ioremap_resource net: ibm: emac: use platform_get_irq net: emac: Fix NULL pointer dereference in emac_probe EDAC/igen6: Initialize edac_op_state according to the configuration data EDAC/igen6: Add polling support EDAC/igen6: Skip absent memory controllers soc: xilinx: Fix race condition in event registration idpf: add idpf_virtchnl.h idpf: bound interrupt-vector register fill to the allocated array btrfs: initialize inode mapping flags for cached inodes svcrdma: Add Write chunk WRs to the RPC's Send WR chain svcrdma: wake sq waiters when the transport closes svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths drm/amdkfd: Fix partial migrate issue drm/amdkfd: return migration pages from copy function Revert "drm/amdkfd: return migration pages from copy function" drm/amdkfd: return migration pages from copy function - again drm/amdgpu: force complete the MES ring fences on reset KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables netfilter: nf_tables: prefer nft_trans_elem_alloc helper netfilter: nf_tables: add nft_trans_commit_list_add_elem helper netfilter: nf_tables: prepare for multiple elements in nft_trans_elem structure net_sched: sch_fq: add three drop_reason net/sched: add qstats_cpu_drop_inc() helper xsk: honor XDP_TX_METADATA in zero-copy path dpll: fix NULL deref in dpll_device_ops() during teardown race bpf: Compare iterator types during state pruning apparmor: fix unconfined user namespace restriction forced stack iommu/vt-d: Flush context cache with correct SID when tearing down aliases btrfs: zoned: don't clobber the extent buffer when zeroing it out wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed bpf: Reject >8 byte return values on return-reading trampoline paths drm/msm: don't tear down KMS twice when KMS init fails mm/hugetlb: refactor code around vmemmap_walk mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier drm/amd/amdgpu: Update PF2VF Header drm/amdgpu: Update SRIOV Exchange Headers for RAS Telemetry Support wifi: iwlwifi: simplify nested if checks virt: acrn: Remove unused list 'acrn_irqfd_clients' PM: sleep: Use bool for all 1-bit fields in struct dev_pm_info PM: sleep: core: Synchronize runtime PM status of parents and children PM: sleep: core: Restrict power.set_active propagation PM: Rearrange documentation related to __pm_runtime_disable() PM: Block enabling of runtime PM during system suspend PM: runtime: Introduce pm_runtime_blocked() PM: sleep: Use DPM_FLAG_SMART_SUSPEND conditionally PM: sleep: Fix bit masking operation driver core: Add device_link_test() for testing device link flags gpiolib: make value setters have return values gpiolib: wrap gpio_chip::set() gpiolib: rework the wrapper around gpio_chip::set_multiple() gpiolib: introduce gpio_chip setters that return values pinctrl: mediatek: paris: don't double-check the GPIO number pinctrl: mediatek: paris: use new GPIO line value setter callbacks genirq/proc: Switch to lock guards genirq: Consistently use '%u' format specifier for unsigned int variables media: chips-media: wave5: Release m2m_ctx after Instance Removed from List i3c: master: svc: Fix npcm845 FIFO empty issue i3c: master: svc: Fix npcm845 invalid slvstart event i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 drm/amdgpu: skip the VMID 0 flush for VRAM tracing: Fix subbuf resize races with trace_pipe_raw readers bpf: Keep refcount_acquire nullable for borrowed RCU kptrs bpf: Reject legacy packet loads from callbacks bpf: Check ancestor frames for rbtree callbacks bpf: Mark signal tracepoint siginfo arguments as scalar net: rename netns_local to netns_immutable net: stmmac: fix dma mapping leak in stmmac_tso_xmit() drm/virtio: Use drm_gem_plane_helper_prepare_fb() drm/virtio: Add a helper to map and note the dma addrs and lengths firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI bpf: Remove migrate_{disable|enable} in bpf_obj_free_fields() dm-integrity: replace forgeable discard filler with a keyed sector marker perf/x86/intel/uncore: Fix uncore_box ref/unref ordering xfs: remove unused trace event xfs_dqreclaim_dirty ublk: fix dead loop when canceling io command s390/kvm: Mask extra bits from program interrupt code scsi: ufs: qcom : Fix NULL pointer dereference in ufs_qcom_setup_clocks accel/ivpu: Fix race condition when mapping dmabuf KVM: SEV: Drop FOLL_WRITE for encrypted region registration net: Fix wild-memory-access in __register_pernet_operations() when CONFIG_NET_NS=n. media: verisilicon: Fix kernel panic due to __initconst misuse soc/tegra: pmc: Document tegra_pmc.syscore field soc/tegra: pmc: Add kerneldoc for wake-up variables i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring sched/psi: Create the psimon kthread outside of cgroup_mutex ocfs2: use correct endian in ocfs2_dinode_has_extents s390/zcrypt: Fix memory leak with CCA cards used as accelerator EDAC/igen6: Fix the flood of invalid error reports netfilter: ctnetlink: do not expose expectation DEAD flag EDAC/igen6: Fix NULL pointer dereference Revert "esp: do not unref managed frag pages in esp_ssg_unref()" mm: constify testing page/folio flags mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback PM: sleep: Unblock runtime PM when device prepare fails soundwire: intel_auxdevice: remove redundant assignment to variable link_flags soundwire: intel_auxdevice: Fix system suspend/resume handling gpiolib: Allow to use setters with return value for output-only gpios gpiolib: initialize return value in gpiochip_set_multiple() i3c: master: svc: Fix missed IBI after false SLVSTART on NPCM845 i3c: master: svc: Fix npcm845 FIFO_EMPTY quirk i3c: master: svc: Fix i3c_master_get_free_addr return check tracing: Fix ring_buffer_read_page_size() kernel-doc tracing: Fix comment in tracing_buffers_splice_read() dm-integrity: fix buffer overflow with keyed discard wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses" UBUNTU: Upstream stable to v6.6.160, v6.12.114 ** Affects: linux (Ubuntu) Importance: Undecided Status: Invalid ** Affects: linux (Ubuntu Noble) Importance: Medium Assignee: Manuel Diewald (diewald) Status: In Progress ** Tags: kernel-stable-tracking-bug ** Changed in: linux (Ubuntu) Status: New => Confirmed ** Also affects: linux (Ubuntu Noble) Importance: Undecided Status: New ** Changed in: linux (Ubuntu) Status: Confirmed => Invalid ** Changed in: linux (Ubuntu Noble) Importance: Undecided => Medium ** Changed in: linux (Ubuntu Noble) Status: New => In Progress ** Changed in: linux (Ubuntu Noble) Assignee: (unassigned) => Manuel Diewald (diewald) ** Summary changed: - Noble update: upstream stable patchset 2026-11-04 + Noble update: upstream stable patchset 2026-11-03 ** Description changed: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: - upstream stable patchset 2026-11-04 + upstream stable patchset 2026-11-03 + + Ported from the following upstream stable releases: + v6.6.160, v6.12.114 + from git://git.kernel.org/ + + xfrm: prevent policy_hthresh.work from racing with netns teardown + Bluetooth: btqcomsmd: Convert to platform remove callback returning void + ieee802154: cc2520: fix FIFOP work use-after-free + openvswitch: prepare for stolen verdict coming from conntrack and nat engine + perf/x86/intel: Update event constraints and cache_extra_regsfor ADL + perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification + scsi: lpfc: Define lpfc_dmabuf type for ctx_buf ptr + net: add and use skb_get_hash_net + usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41 + drm/amd/display: Mark DCE 6.4 as not APU + erofs: avoid infinite loops due to corrupted subpage compact indexes + erofs: unify lcn as u64 for 32-bit platforms + iio: adc: axp288: Add TS bias override for Haier HV103H + HID: core: introduce hid_safe_input_report() + HID: uhid: convert to hid_safe_input_report() + netfilter: nft_set_pipapo: restore cloned mapping table memcg accounting + pmdomain: rockchip: propagate subdomain add errors + iio: light: Drop ROHM BU27034 + UBUNTU: [Config] remove CONFIG_ROHM_BU27034 + dlm: validate length in dlm_search_rsb_tree + HID: steam: Clean up locking + ip6_gre: remove obsolete ERSPAN PMTU update + mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP + mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge + ALSA: pcm: oss: Fix setup list UAF on proc write error + ALSA: mixer: oss: Add card disconnect checkpoints + net: team: rename team to team_core for linking + net: team: Remove unused team_mode_op, port_enabled + net: team: Rename port_disabled team mode op to port_tx_disabled + net: team: fix NULL pointer dereference in team_xmit during mode change + net: team: stop reusing skb after queue override + Bluetooth: hci_sync: Fix command skb lifetime during scan setup + Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex + drm/vmwgfx: validate pitch coming from userspace + namespace: don't inherit MNT_UMOUNT in clone_mnt() + namespace: check the mounts before reading their parents in pivot_root() + net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv + ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params + scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ + scsi: ch: Do not keep references to data transfer element devices + scsi: ufs: mcq: Remove unused parameters + scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe() + scsi: ufs: core: Add debug log for MCQ command timeout + scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock() + scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() + drm/vc4: Fix firmware reference leak in vc4_drm_bind() + namespace: unhash a dentry before detaching the mounts on it + namespace: check the target before walking it in do_mount_setattr() + fcntl: refuse F_SET_RW_HINT on an immutable inode + namespace: handle mount locking for automounts correctly + tty: add break_wait kernel-doc + net: nexthop: Have all NH notifiers carry NH ID + net: nexthop: Increase weight to u16 + drm/amdgpu: change vm->task_info handling + bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro() + ice: Don't process extts if PTP is disabled + ice: Fix improper extts handling + gve: Account for stopped queues when reading NIC stats + serial: sc16is7xx: fix TX fifo corruption + scsi: lpfc: Fix failure to delete vports when discovery is in progress + scsi: lpfc: Remove shost_lock protection for fc_host_port shost APIs + scsi: lpfc: Change nlp state statistic counters into atomic_t + scsi: lpfc: Protect vport fc_nodes list with an explicit spin lock + scsi: lpfc: Change lpfc_vport fc_flag member into a bitmask + l2tp: prevent possible tunnel refcount underflow + fuse: Fix missing FOLL_PIN for direct-io + udmabuf: change folios array from kmalloc to kvmalloc + udmabuf: fix memory leak on last export_udmabuf() error path + PCI: imx6: Fix suspend/resume support on i.MX6QDL + RDMA/siw: Remove direct link to net_device + mm: clear uffd-wp PTE/PMD state on mremap() + btrfs: do proper folio cleanup when run_delalloc_nocow() failed + btrfs: do proper folio cleanup when cow_file_range() failed + ax25: Remove broken autobind + RISC-V: KVM: Teardown riscv specific bits after kvm_exit + wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info + wifi: ath12k: fix incorrect TID updation in DP monitor status path + wifi: ath12k: Avoid explicit type cast in monitor status parse handler + wifi: ath12k: Avoid memory leak while enabling statistics + perf: Fix hang while freeing sigtrap event + smb: client: allocate crypto only for primary server + smb: client: fix UAF in decryption with multichannel + ublk: fix handling recovery & reissue in ublk_abort_queue() + fs/ntfs3: Use function file_inode to get inode from file + fs/ntfs3: Separete common code for file_read/write iter/splice + fs/ntfs3: Keep write operations atomic + drm/amd/display: prevent hang on link training fail + kasan: avoid sleepable page allocation from atomic context + clk: sunxi-ng: h616: Reparent CPU clock during frequency changes + clk: sunxi-ng: h616: Reparent GPU clock during frequency changes + dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn + virtio: make virtio_bus const + virtio: hookup irq_get_affinity callback + virtio: break and reset virtio devices on device_shutdown() + wifi: iwlwifi: don't warn when if there is a FW error + coresight: holding cscfg_csdev_lock while removing cscfg from csdev + riscv: save the SR_SUM status over switches + s390/mm: Fix in_atomic() handling in do_secure_storage_access() + drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port + wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() + rv: Use strings in da monitors tracepoints + wifi: iwlwifi: return ERR_PTR from opmode start() + wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() + net/sched: Fix backlog accounting in qdisc_dequeue_internal + mm/smaps: fix race between smaps_hugetlb_range and migration + crypto: x86/aegis128 - eliminate some indirect calls + crypto: x86/aegis128 - optimize length block preparation using SSE4.1 + crypto: x86/aegis128 - improve assembly function prototypes + crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT + crypto: x86/aegis - Add missing error checks + ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog + wifi: mt76: mt7915: fix list corruption after hardware restart + mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() + smb: client: let recv_done verify data_offset, data_length and remaining_data_length + dm-verity: provide dma_alignment limit in io_hints + dm-stripe: limit chunk_sectors to the stripe size + iommu/s390: Make attach succeed when the device was surprise removed + bpf: improve error message for unsupported helper + bpf: add a get_helper_proto() utility function + bpf: Check the helper function is valid in get_helper_proto + RISC-V: KVM: Write hgatp register with valid mode bits + tcp_metrics: use dst_dev_net_rcu() + crypto: hisilicon/qm - request reserved interrupt for virtual function + net: use dst_dev_rcu() in sk_setup_caps() + ASoC: Intel: avs: Do not share the name pointer between components + tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() + mlx5: Fix default values in create CQ + drm/amdgpu: fix gpu page fault after hibernation on PF passthrough + scsi: ufs: qcom : Refactor phy_power_on/off calls + scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) + scsi: imm: Fix use-after-free bug caused by unfinished delayed work + gfs2: Prevent recursive memory reclaim + coresight: ETR: Fix ETR buffer use-after-free issue + wifi: ath12k: Fix MSDU buffer types handling in RX error path + scsi: qla2xxx: Clear cmds after chip reset + Input: alps - fix use-after-free bugs caused by dev3_register_work + Input: lkkbd - disable pending work before freeing device + usb: gadget: Support already-mapped DMA SGs + usb: gadget: functionfs: Factorize wait-for-endpoint code + functionfs, gadgetfs: use simple_recursive_removal() + functionfs: fix the open/removal races + wifi: mac80211: don't WARN for connections on invalid channels + PCI: endpoint: Add missing NULL check for alloc_workqueue() + bpf: Mark bpf_refcount field as unique + staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths + of: unittest: Fix memory leak in unittest_data_add() + ALSA: usb-audio: Prevent excessive number of frames + tcp: secure_seq: add back ports to TS offset + cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() + sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting + ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz + serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN + fs: super_set_uuid() + ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION + drm/amdgpu: Remove usage of the deprecated ida_simple_xx() API + drm/amdgpu: prevent immediate PASID reuse case + cxl/port: Fix use after free of parent_port in cxl_detach_ep() + ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() + s390/mm: Add missing secure storage access fixups for donated memory + KVM: SEV: Use long-term pin when registering encrypted memory regions + KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock + usb: gadget: f_hid: don't call cdev_init while cdev in use + rxrpc: proc: size address buffers for %pISpc output + net: lan966x: fix page pool leak in error paths + Bluetooth: hci_event: move wake reason storage into validated event handlers + bpf: Fix incorrect pruning due to atomic fetch precision tracking + Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists + mpls: add seqcount to protect the platform_label{,s} pair + HID: core: Add reserved item tag for main items + HID: rate-limit hid_warn to prevent log flooding + HID: core: Mitigate potential OOB by removing bogus memset() + ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() + types: move struct rcuwait into types.h + irqwork: Move data struct to a types header + srcu: Use irq_work to start GP in tiny SRCU + btrfs: tree-log: don't use token set/get accessors in fill_inode_item() + btrfs: fix zero size inode with non-zero size after log replay + fs/ntfs3: Accumulated refactoring changes + ntfs3: fix circular locking dependency in run_unpack_ex + wifi: iwlwifi: fix 22000 series SMEM parsing + wifi: rtw89: pci: validate sequence number of TX release report + team: avoid NETDEV_CHANGEMTU event when unregistering slave + drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels + drm/amdgpu: Skip vcn poison irq release on VF + btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() + btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() + i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue + i3c: mipi-i3c-hci: Fix race in DMA ring dequeue + ASoC: amd: acp-mach-common: Add missing error check for clock acquisition + net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ + iommu/vt-d: Clear Present bit before tearing down PASID entry + bpf: Fix tcx/netkit detach permissions when prog fd isn't given + btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation + net: stmmac: fix oops when split header is enabled + gfs2: fix memory leaks in gfs2_fill_super error path + KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT + KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN + KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 + dm-verity-fec: fix reading parity bytes split across blocks (take 3) + spi: microchip-core-qspi: control built-in cs manually + riscv: kvm: fix vector context allocation leak + f2fs: fix fsck inconsistency caused by FGGC of node block + RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() + spi: mpc52xx: fix controller deregistration + drm/amd/display: Fix dc_link NULL handling in HPD init + coresight: tmc-etr: Fix race condition between sysfs and perf mode + selinux: allow multiple opens of /sys/fs/selinux/policy + netfilter: nf_tables: use list_del_rcu for netlink hooks + Revert "net/smc: Introduce TCP ULP support" + tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR + libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() + sched/psi: fix race between file release and pressure write + netfilter: nat: use kfree_rcu to release ops + ice: fix double-free of tx_buf skb + f2fs: fix data loss caused by incorrect use of nat_entry flag + f2fs: avoid reading already updated pages during GC + greybus: raw: fix use-after-free on cdev close + iommu/amd: Fix clone_alias() to use the original device's devid + net: pull headers in qdisc_pkt_len_segs_init() + powerpc/64s: Fix unmap race with PMD migration entries + powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy + vdpa: use generic driver_override infrastructure + PCI: use generic driver_override infrastructure + fs/mbcache: cancel shrink work before destroying the cache + staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction + Staging: rtl8723bs: Remove dead code from _rtw_free_network() + Staging: rtl8723bs: Delete dead code from update_current_network() + staging: rtl8723bs: clean up redundant & parentheses + staging: rtl8723bs: fix buffer over-read in rtw_update_protection + wifi: fix leak if split 6 GHz scanning fails + l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() + btrfs: only release the dirty pages io tree after successful writes + net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind + net: mana: Guard mana_remove against double invocation + wifi: mt76: mt7921: Place upper limit on station AID + drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() + drm/msm: always recover the gpu + fbdev: omap2: fix inconsistent lock returns in omapfb_mmap + fbdev: omap2: fix use-after-free in omapfb_mmap + f2fs: read COW data with the original inode during atomic write + gcov: use atomic counter updates to fix concurrent access crashes + drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring + drm/amdgpu: fix amdgpu_hmm_range_get_pages + usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() + usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers + Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close + net/handshake: Drain pending requests at net namespace exit + ethtool: rss: fix indir_table and hkey leak on get_rxfh failure + cgroup/rstat: validate cpu before css_rstat_cpu() access + hwmon: (lm90) Stop work before releasing hwmon device + netfilter: bridge: eb_tables: close module init race + netfilter: ebtables: move to two-stage removal scheme + mm/util: Introduce kmemdup_array() + netfilter: Use kmemdup_array instead of kmemdup for multiple allocation + netfilter: x_tables: allow initial table replace without emitting audit log message + netfilter: x_tables: allocate hook ops while under mutex + wifi: mac80211: fix missing RX bitrate update for mesh forwarding path + wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb + erofs: fix metabuf leak in inode xattr initialization + drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() + hwmon: (lm90) Add lock protection to lm90_alert + smb/client: fix chown/chgrp with SMB3 POSIX Extensions + ksmbd: validate NTLMv2 response before updating session key + ksmbd: prevent path traversal bypass by restricting caseless retry + ALSA: hda/cs35l41: Fix firmware load work teardown + net/handshake: Take a long-lived file reference at submit + KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state + LoongArch: Move jump_label_init() before parse_early_param() + drm/vc4: Shut down BO cache timer before teardown + drm/amdgpu: Use dbg level for VBIOS check messages + drm/amdgpu: Add wrapper for freeing vbios memory + drm/amdgpu: Release VFCT ACPI table reference + drm/i915/mst: limit DP MST ESI service loop + drm/i915/gt: Fix NULL deref on sched_engine alloc failure + drm/amdkfd: Check bounds on CRIU restore queue type and mqd size + cifs: prevent readdir from changing file size due to stale directory metadata + cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths + tipc: serialize udp bearer replicast list updates + firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() + wifi: cfg80211: use wiphy work for socket owner autodisconnect + wifi: mac80211: refactor populating mesh related fields in sinfo + wifi: cfg80211: add link_station_info structure to support MLO statistics + wifi: mac80211: defer link RX stats percpu free to RCU + RDMA/irdma: Prevent user-triggered null deref on QP create + xfrm: fix stale skb->prev after async crypto steals a GSO segment + LoongArch: Fix address space mismatch in kexec command line lookup + net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains + ovl: check access to copy_file_range source with src mounter creds + s390/zcrypt: Fix buffer over-read in cca_cipher2protkey + wifi: ieee80211: validate MLE common info length + mmc: vub300: fix use-after-free on probe failure + dm-verity: fix buffer overflow in FEC calculation + ocfs2: correct l_next_free_rec in online check + ocfs2: add suballoc slot check in ocfs2_validate_inode_block() + ocfs2: validate i_refcount_loc when refcount flag is set + ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec + fs: Remove NTFS classic + UBUNTU: [Config] remove classic NTFS options + KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling + ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() + net/liquidio: drop cached VF pci_dev LUT + Bluetooth: 6lowpan: avoid untracked enable work + net/mlx5e: Fix publication race for priv->channel_stats[] + afs: Fix reinitialisation of the inode, in particular ->lock_work + xen/pvcalls: bound backend response req_id before indexing rsp[] + sctp: fix addr_wq_timer race in sctp_free_addr_wq() + hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() + sctp: add INIT verification after cookie unpacking + tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() + bpf: net: netfilter: drop dead NULL checks + bpf: Guard conntrack opts error writes + md/raid10: fix writes_pending leak on write request failures + md/raid1: fix writes_pending and barrier reference leaks on write failures + soundwire: fix bug in sdw_add_element_group_count found by syzkaller + RDMA/irdma: Replace waitqueue and flag with completion + RDMA/bnxt_re: Avoid repeated requests to allocate WC pages + RDMA/bnxt_re: Initialize dpi variable to zero + sockmap: Fix use-after-free in udp_bpf_recvmsg() + ALSA: seq: fifo: Use guard() for locking + ALSA: seq: Clean up fifo locking with guard + ALSA: seq: avoid stale FIFO cells during resize + net: watchdog: fix refcount tracking races + bnxt: fix head underflow on XDP head-grow + cxl/region: Block region delete during region creation + ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT + ixgbe: do not configure xps for XDP queues + bpf: Reject sleepable BPF_LSM_CGROUP programs at load time + bpf: Clear rb node linkage when freeing bpf_rb_root + ocfs2: add extra consistency checks for chain allocator dinodes + ocfs2: validate fast symlink target during inode read + vhost: correct misleading printing information + vhost: move smp_rmb() into vhost_get_avail_idx() + wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() + md/raid1,raid10: fix deadlock in read error recovery path + ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data + OPP: Fix race between OPP addition and lookup + wifi: ath11k: cancel SSR work items during PCI shutdown + s390/zcrypt: Close speculative mem read possibility + octeontx2-af: Block VFs from clobbering special CGX PKIND state + Bluetooth: ISO: hold sk properly in iso_conn_ready + net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds + xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx + btrfs: skip global block reserve accounting for rescue mounts + mm/page_table_check: skip special zero mappings + eventfs: Use children field for rcu head and add memory barriers + selftests: tls: add test with a partially invalid iov + selftests: tls: add rekey tests + tls: rx: restore msg_iter before TLS 1.3 optimistic retry + watchdog: at91sam9_wdt: prevent timer rearm during teardown + s390/ism: Fix UAF of sba and ieq during ism_dev_exit() + netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() + hwmon: (pmbus) Fix type confusion in notification logic + vhost_iotlb: bound map allocation in add_range + bpf: Fix netns reference imbalance in conntrack kfuncs + btrfs: lzo: reject inline extents without valid headers + soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read + gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock + firewire: ohci: fix NULL pointer dereference in ar_context_release + ipvs: revalidate ihl to prevent out-of-bounds access + sctp: validate cookie AUTH state before use + scsi: core: pair EH runtime PM get and put + tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg + ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() + coresight: ete: Always save state on power down + ALSA: seq: oss: Serialize readq reset state with q->lock + btrfs: lzo: reject compressed segment that overflows the compressed input + netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag + EDAC/igen6: Fix call trace due to missing release() + scsi: hisi_sas: Add slave_destroy interface for v3 hw + cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size + netfilter: nf_conntrack_expect: use conntrack GC to reap expectations + Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks + dmaengine: idxd: fix double free of wq, engine, and group structs + bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie + drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length + drm/amdkfd: Add bounds check for CRAT subtype length + Bluetooth: ISO: zero the sockaddr before returning it in getname + fbdev: Wrap user-invoked calls to fb_set_var() in helper + RDMA/rxe: Remove redundant scheduling of rxe_completer + RDMA/rxe: Merge request and complete tasks + tipc: avoid busy looping in tipc_exit_net() + NTB: core: Add .get_dma_dev() callback to ntb_dev_ops + NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers + ntb: Store original DMA address for future release + tap: Keep hdr_len in tap_get_user() + net: tap: fix wrong transport_header when sending VLAN-tagged frame + io_uring: defer eventfd signaling when queued from a wakeup handler + wifi: iwlwifi: dvm: pair transport op-mode enter/leave + wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() + power: supply: lp8788: Use devm_power_supply_register() helper + filelock: split common fields into struct file_lock_core + lockd: adapt to breakup of struct file_lock + svcrdma: Refactor the creation of listener CMA ID + sunrpc: xprtrdma: Use ERR_CAST() to return + svcrdma: Reject Read lists that exceed the page budget + svcrdma: Handle ADDR_CHANGE CM event properly + SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 + ext2: Fix lost inode updates for IS_SYNC inodes + smb: client: reject a tree connect response whose byte count is too small + smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() + cifs: call pagecache_isize_extended() in cifs_setsize() when extending + ceph: cap delegated inode count in ceph_parse_deleg_inos() + ceph: fix UAF in check_new_map() on session freed during unlock + nfsd: fix stale s2s_cp_stateids IDR entry for async COPY + nfsd: split sc_status out of sc_type + lockd, nfsd: RCU-protect nlmsvc_ops dispatch + nfsd: Pass 'cred' instead of 'rqstp' to some functions. + mm/mglru: fix and remove redundant unevictable folio handling + ksmbd: fix uninitialized symbol 'share' in smb2_tree_connect() + ksmbd: fix tree connection use-after-free in smb2_tree_connect() + drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram + drm/amdkfd: Fix error path at svm_migrate_copy_to_ram + drm/amdkfd: Add TLB flush after MES queue eviction/suspension + drm/amdgpu: force complete the KIQ ring fences on reset + f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() + LoongArch: BPF: Refactor jump offset calculation in tail call + KVM: s390: Fix memory corruption by not reinjecting CK machine checks + mm/huge_memory: transfer the pmd dirty bit to the folio on zap + netfilter: nf_tables: skip double clone set expressions on element insert + net/sched: act_ife: Only operate on Ethernet frames + octeontx2-vf: fix workqueue and netdev race in probe/remove + Bluetooth: do not leak an hci_conn when a second LE connect is rejected + Bluetooth: L2CAP: access chan->conn safely in get/setsockopt + Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition + net/sched: account classifier filter allocations to memcg + NFSv4.1: zero referring call lists before decoding + vxlan: fix reading neigh ha + net: bridge: arp/nd proxy: fix reading neigh ha + ip6mr: do not clone dst in ip6mr_cache_report() + ALSA: mtpav: shut down output timer before card teardown + filelock: add some new helper functions + NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers + ksmbd: scope session state changes to bound connections + ksmbd: detach blocked lock requests before freeing + ksmbd: safely discard unregistered deferred locks + erofs: fix interlaced ztailpacking pclusters + ksmbd: defer publishing granted locks to prevent UAF/double-free race + ksmbd: serialize oplock close with pending break ownership + ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() + apparmor: fix deadlock in complain-mode change_hat + blk-cgroup: delay freeing policy data after rcu grace period + blk-iocost: clear delay state when freeing policy data + blk-iolatency: clear delay state when freeing policy data + ocfs2: validate DIO orphan slot during inode read + ocfs2: validate orphan slot during inode read + nvmet: fix max_qid race between configfs and controller allocation + clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type + amt: Don't support cross-netns setup. + NFS: Return a delegation the client fails to record + bpf: Fix mmap_lock leak in irq_work path + Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero + Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind + btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() + btrfs: check if root is readonly when setting posix acl + btrfs: always wait for ordered extents to avoid OE races + btrfs: defrag: fix deadlock between defrag and delalloc space reservation + scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails + coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable + drm/amd/display: Resize MST HDCP per-connector arrays to 32 + bpf: Clear buf on error in __bpf_get_task_stack + ocfs2/heartbeat: fix slot mapping rollback leaks on error paths + ocfs2: o2hb: quiesce negotiate handlers and timeout work + thermal: hwmon: Remove hwmon class device along with its parent + ocfs2: validate inline xattrs during inode block validation + ublk: check import_ubuf() return value + blk-cgroup: fix race between policy activation and blkg destruction + HID: steam: Reject short reads + HID: logitech-hidpp: Fix FF device cleanup on init failure + tty: skip cdev_del() when no cdev is registered + serial: core: clear freed pointers on uart_register_driver() failure + serial: core: do fallible allocations before the console can be registered + wifi: cfg80211: stop PMSR before P2P and NAN teardown + wifi: brcmfmac: fix P2P action frame handling without device vif + wifi: nl80211: check link is beaconing for color change + wifi: nl80211: clean up color-change beacon data on errors + arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry + wifi: mt76: cancel reset and rc work on device unregister + wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER + wifi: mt76: mt7915: allocate vif wcid in the same range as stations + wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface() + wifi: mt76: mt7915: unwind state on add_interface failure + wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() + RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() + PCI: Make pci_match_one_device() match on ID instead of device + PCI: Fix dyn_id add TOCTOU + PCI: Fix UAF when probe runs concurrent to dyn ID removal + clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path + scsi: ufs: core: Convert string descriptor format macros to enum + scsi: ufs: core: Validate string descriptors + pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip + bpf: Fix WARNING in bpf_tracing_link_release + ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() + bpf: remove unused parameter in bpf_jit_binary_pack_finalize + bpf: Zero queue and stack outputs on lock failure + drm/sched: Use struct for drm_sched_init() params + drm/msm: Only fini scheduler after successful init + firmware: arm_scmi: Fix SCMI device destroy lifetimes + RDMA/rvt: Return NULL after port allocation failure + esp: do not unref managed frag pages in esp_ssg_unref() + platform/x86: asus-wmi: fix resource leaks on probe failure + usb: gadget: uac: validate rate list length before storing + bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max + platform/x86: lg-laptop: Fix LED resource handling + platform/x86: dell-wmi-base: Fix handling of ultra performance key + bpf: Reject writes through untrusted BTF pointers + time/namespace: Validate nanosecond field in proc_timens_set_offset() + bpf: Reject MEM_ALLOC BTF accesses past object bounds + cgroup/cpuset: introduce cpuset-v1.c + dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout + drm/amd/display: Fix dangling pointer in CRTC reset function + drm/amd/display: Fix dangling pointer in plane reset function + i3c: master: Fix recursive locking during device registration + mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() + nfsd: convert nfsd_net boolean flags to unsigned long flags word + ACPI: bus: Introduce acpi_bus_get_primary_device() + powerpc/xive: add error return value to xive_smp_probe() + powerpc/xive: propagate IPI init errors to prevent use-after-free + remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 + ksmbd: remove redundant DACL check in smb_check_perm_dacl + ksmbd: fix maximum allowed access checks + drm/amdkfd: fix SMI event cross-process information leak + drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq + wifi: iwlwifi: mvm: fix P2P-Device binding handling + RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() + virt: acrn: Fix irqfd use-after-free during eventfd shutdown + driver core: Avoid warning when removing a device while its supplier is unbinding + serial: 8250: invert serial8250_register_8250_port() CIR condition + tty: serial: 8250: protect against NULL uart->port.dev in register + drm/amdgpu: Remove unused amdgpu_i2c functions + drm/amdgpu/atombios: drop empty function + drm/amdgpu: rework i2c init and fini + drm/amdgpu: Bound GPIO I2C table entry count from VBIOS + pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction + genirq/proc: Size interrupt directory names for 10-digit interrupt numbers + bpf: Mark raw_tp arguments with PTR_MAYBE_NULL + net: dsa: b53: do not enable EEE on bcm63xx + ACPI: platform: Use acpi_bus_get_primary_device() + drm/msm: Recover HW before retire hung submit + ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS + RDMA/efa: Fix use of completion ctx after free + ASoC: qcom: q6asm: handle the responses after closing + ASoC: qcom: q6asm: drop DSP responses for closed data streams + media: hantro: Disable multicore support + media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure + media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC + hwrng: core - use RCU and work_struct to fix race condition + KVM: SVM: Add missing save/restore handling of LBR MSRs + ceph: fix num_ops off-by-one when crypto allocation fails + greybus: raw: fix use-after-free if write is called after disconnect + erofs: fix use-after-free on sbi->sync_decompress + net/handshake: hand off the pinned file reference to accept_doit + cxl/region: Resolve region deletion races + md/raid1,raid10: fix bio accounting for split md cloned bios + md/raid1,raid10: fix error-path detection with md_cloned_bio() + iommu: Pass domain to remove_dev_pasid() op + nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net + ocfs2: validate external xattr entries when reading metadata + fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() + smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() + smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid + ALSA: usx2y: Use standard print API + perf/x86/intel: Prevent drain_pebs() reentry + net/mlx5e: Move representor vnic reporter to eswitch devlink port + Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() + vhost: invalidate vring access on IOTLB transitions + vduse: validate virtqueue alignment + virtio_ring: fix stale descriptor flags after a failed packed add + iommu/amd: Do not reallocate GA log buffers on resume + bpf: mark a NULL call argument precise + bpf: Preserve inner map identity in callback frames + bpf: Mark NULL kptr stores precise + bpf: Don't infer non-NULL from a pointer with an unbounded offset + nvme_core: scan namespaces asynchronously + bpf: Mark syscall helpers as sleepable + erofs: disable LZ4 rolling decompression for now + net: plumb extack in __dev_change_net_namespace() + net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). + btrfs: zstd: fix lost wakeup when waiting for a workspace + bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks + bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge + ipv6: mcast: use rcu_assign_pointer() for __rcu list updates + smb/client: invalidate fscache for fallocate range operations + smb/client: fix stale page cache in insert/collapse range + bpf: check_cond_jmp_op(): properly infer if register is null + drm/gud: validate GUD_ROTATION_0 is present in supported rotations + drm/virtio: use the DMA API for resource backing on Xen + smb/server: fix tree connection leak in smb2_tree_connect() + r8169: remove original workaround for RTL8125 broken rx issue + ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 + Revert "ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev()" + Revert "mm/filemap: avoid buffered read/write race to read inconsistent data" + xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock + xfs: catch stale AGF/AGF metadata + xfs: rearrange code in xfs_buf_item.c + xfs: factor out stale buffer item completion + xfs: fix unmount hang with unflushable inodes stuck in the AIL + bpf, sockmap: Account for receive queue in FIONREAD without a verdict program + ksmbd: fix heap out-of-bounds write in krb5_authenticate() + KVM: x86: Use active memslots for the per-vCPU MMIO cache + spi: mpc52xx: clean up interrupt handling + iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported + iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() + xfs: avoid dquot buffer pin deadlock + drm/amd: Create a device link between APU display and XHCI devices + ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands + wifi: mt76: connac: tolerate inactive BSS deactivation + drm/vmwgfx: Stop using dev_private to store driver data. + net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop + riscv: Use offset_in_page() in text patching functions + riscv: patch: Avoid early phys_to_page() + riscv: patch: fix handling of bpf-jit execmem addresses + drm/vc4: Use video aperture helpers + smb: client: improve compound padding in encryption + smb: client: get rid of bounds check in SMB2_ioctl_init() + smb: client: fix compound alignment with encryption + drm/i915/display: support struct intel_atomic_state in to_intel_display() + drm/i915/display: pass display to intel_crtc_for_pipe() + drm/i915/vga: Convert VGA code to intel_display + drm/i915/display: convert I915_STATE_WARN() to struct intel_display + drm/i915/de: register wait function renames + drm/i915: add generic __to_intel_display() + drm/i915/display: accept either i915 or display for feature tests + drm/i915/de: allow intel_display and drm_i915_private for de functions + drm/i915/gmbus: convert to struct intel_display + drm/i915/crt: convert to struct intel_display + drm/i915: Grab intel_display from the encoder to avoid potential oopsies + f2fs: quota: fix to avoid warning in dquot_writeback_dquots() + perf/dwc_pcie: Add support for QCOM vendor devices + perf/dwc_pcie: Qualify RAS DES VSEC Capability by Vendor, Revision + perf/dwc_pcie: fix duplicate pci_dev devices + ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd + wifi: ath12k: convert struct ath12k_sta::update_wk to use struct wiphy_work + wifi: ath12k: prepare vif data structure for MLO handling + wifi: ath12k: Fix memory leak due to multiple rx_stats allocation + mm: fix uprobe pte be overwritten when expanding vma + riscv: Enable cbo.zero only when all harts support Zicboz + riscv: Add support for per-thread envcfg CSR values + s390/kvm: Remove kvm_arch_fault_in_page() + s390/mm: Simplify get_fault_type() + s390/mm: Get rid of fault type switch statements + platform/x86/amd/pmf: Switch to platform_get_resource() and devm_ioremap_resource() + platform/x86/amd: pmf: Use device managed allocations + drm/rockchip: vop2: Consistently use dev_err_probe() + drm/rockchip: vop2: Register the primary plane and overlay plane separately + rv: Remove trailing whitespace from tracepoint string + mm/mremap: fix WARN with uffd that has remap events disabled + iommu/s390: handle IOAT registration based on domain + iommu/s390: set appropriate IOTA region type + drm/xe: Don't allow evicting of BOs in same VM in array of VM binds + ASoC: Intel: avs: Use topology information for endpoint numbers + sysfs: check visibility before changing group attribute ownership + amd/amdkfd: enhance kfd process check in switch partition + RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage + net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET + net/mlx5: Store the global doorbell in mlx5_priv + net/mlx5e: Prepare for using different CQ doorbells + net: vxlan: prevent NULL deref in vxlan_xmit_one + wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks + accel/ivpu: Allow to import single buffer into multiple contexts + accel/ivpu: Rework bind/unbind of imported buffers + accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() + accel/qaic: Add config structs for supported cards + net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels + idpf: fix error handling in the init_task on load + riscv: trace: fix snapshot deadlock with sbi ecall + bpf: Fix exception exit lock checking for subprogs + drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register + dm: limit swapping tables for devices with zone write plugs + net: use synchronize_rcu_expedited in cleanup_net() + net: Factorise setup_net() and cleanup_net(). + net: Add ops_undo_single for module load/unload. + net: Add ->exit_rtnl() hook to struct pernet_operations. + wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit + bnxt_en: set backing store type from query type + xfs: remove bp->b_error check in xfs_attr3_root_inactive + xfs: factor out xfs_attr3_node_entry_remove + xfs: close crash window in attr dabtree inactivation + drm/amd/display: Add a function for checking tmds mode + drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 + media: chips-media: wave5: Fix Null reference while testing fluster + btrfs: remove 'reserved' argument from btrfs_pin_extent() + md raid: fix hang when stopping arrays with metadata through dm-raid + KVM: Rename symbols related to enabling virtualization hardware + KVM: Export hardware virtualization enabling/disabling functions + syscore: Pass context data to callbacks + wifi: iwlwifi: mvm: don't send a 6E related command when not supported + rxrpc: kdoc: Update function descriptions and add link from rxrpc.rst + rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() + nouveau/gsp: drop WARN_ON in ACPI probes + KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" + doc: Clarify use of slab constructors and SLAB_TYPESAFE_BY_RCU + refcount: provide ops for cases when object's memory can be reused + wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync + wifi: mt76: Fix memory leak destroying device + iommu/vt-d: Avoid NULL pointer dereference or refcount corruption + drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED + wifi: mt76: add wcid publish check in mt76_sta_add + netfs: Fix leak of request in netfs_write_begin() error handling + netfs: Fix zeropoint update where i_size > remote_i_size + KVM: guest_memfd: Treat memslot binding offset+size as unsigned values + KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state + KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) + KVM: x86: Rename APIC base setters to better capture their relationship + KVM: x86: Move update_cr8_intercept() to lapic.c + KVM: x86: Unconditionally recompute CR8 intercept on PPR update + media: stm32: dcmipp: use v4l2_subdev_is_streaming + media: stm32: dcmipp: replace s_stream with enable/disable_streams + media: stm32-dcmipp: Return queued buffers on start_streaming() failure + idpf: fix max_vport related crash on allocation error during init + LoongArch: BPF: Zero-extend signed ALU32 div/mod results + bnxt_en: Handle partially initialized auxiliary devices + drm/xe/guc: Keep scheduler timeline name alive + Bluetooth: hci_sync: extend conn_hash lookup critical sections + bpf: Disable migration when destroying sock storage + bpf: Disable migration when cloning sock storage + rcu: add rcu_read_lock_dont_migrate() + bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c + wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() + drm/amd/display: use kvzalloc to allocate struct dc + drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size + wifi: mac80211: validate extension-frame layout before RX + ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC + ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD + mmc: vub300: Use devm_mmc_alloc_host() helper + mmc: vub300: fix use-after-free on disconnect + mmc: vub300: rename probe error labels + RDMA/bnxt_re: Free CQ toggle page after firmware teardown + nvmet-tcp: check return value of nvmet_tcp_set_queue_sock + s390/ap: Move response_type struct into ap_msg struct + s390/ap/zcrypt: Rework AP message buffer allocation + s390/ap: Introduce ap message buffer pool + s390/ap/zcrypt: New xflag parameter + s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code + s390/zcrypt: Rework domain processing within zcrypt device driver + afs: Fix UAF when sending a message + Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback + Bluetooth: ISO: lock sk in iso_connect_ind + xsk: drain continuation descs after overflow in xsk_build_skb() + xsk: provide sufficient space in pool->tx_descs + xsk: reclaim invalid Tx descriptors in ZC batch path + net: ibm: emac: use devm_platform_ioremap_resource + net: ibm: emac: use platform_get_irq + net: emac: Fix NULL pointer dereference in emac_probe + EDAC/igen6: Initialize edac_op_state according to the configuration data + EDAC/igen6: Add polling support + EDAC/igen6: Skip absent memory controllers + soc: xilinx: Fix race condition in event registration + idpf: add idpf_virtchnl.h + idpf: bound interrupt-vector register fill to the allocated array + btrfs: initialize inode mapping flags for cached inodes + svcrdma: Add Write chunk WRs to the RPC's Send WR chain + svcrdma: wake sq waiters when the transport closes + svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails + nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths + drm/amdkfd: Fix partial migrate issue + drm/amdkfd: return migration pages from copy function + Revert "drm/amdkfd: return migration pages from copy function" + drm/amdkfd: return migration pages from copy function - again + drm/amdgpu: force complete the MES ring fences on reset + KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables + netfilter: nf_tables: prefer nft_trans_elem_alloc helper + netfilter: nf_tables: add nft_trans_commit_list_add_elem helper + netfilter: nf_tables: prepare for multiple elements in nft_trans_elem structure + net_sched: sch_fq: add three drop_reason + net/sched: add qstats_cpu_drop_inc() helper + xsk: honor XDP_TX_METADATA in zero-copy path + dpll: fix NULL deref in dpll_device_ops() during teardown race + bpf: Compare iterator types during state pruning + apparmor: fix unconfined user namespace restriction forced stack + iommu/vt-d: Flush context cache with correct SID when tearing down aliases + btrfs: zoned: don't clobber the extent buffer when zeroing it out + wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed + bpf: Reject >8 byte return values on return-reading trampoline paths + drm/msm: don't tear down KMS twice when KMS init fails + mm/hugetlb: refactor code around vmemmap_walk + mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier + drm/amd/amdgpu: Update PF2VF Header + drm/amdgpu: Update SRIOV Exchange Headers for RAS Telemetry Support + wifi: iwlwifi: simplify nested if checks + virt: acrn: Remove unused list 'acrn_irqfd_clients' + PM: sleep: Use bool for all 1-bit fields in struct dev_pm_info + PM: sleep: core: Synchronize runtime PM status of parents and children + PM: sleep: core: Restrict power.set_active propagation + PM: Rearrange documentation related to __pm_runtime_disable() + PM: Block enabling of runtime PM during system suspend + PM: runtime: Introduce pm_runtime_blocked() + PM: sleep: Use DPM_FLAG_SMART_SUSPEND conditionally + PM: sleep: Fix bit masking operation + driver core: Add device_link_test() for testing device link flags + gpiolib: make value setters have return values + gpiolib: wrap gpio_chip::set() + gpiolib: rework the wrapper around gpio_chip::set_multiple() + gpiolib: introduce gpio_chip setters that return values + pinctrl: mediatek: paris: don't double-check the GPIO number + pinctrl: mediatek: paris: use new GPIO line value setter callbacks + genirq/proc: Switch to lock guards + genirq: Consistently use '%u' format specifier for unsigned int variables + media: chips-media: wave5: Release m2m_ctx after Instance Removed from List + i3c: master: svc: Fix npcm845 FIFO empty issue + i3c: master: svc: Fix npcm845 invalid slvstart event + i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 + drm/amdgpu: skip the VMID 0 flush for VRAM + tracing: Fix subbuf resize races with trace_pipe_raw readers + bpf: Keep refcount_acquire nullable for borrowed RCU kptrs + bpf: Reject legacy packet loads from callbacks + bpf: Check ancestor frames for rbtree callbacks + bpf: Mark signal tracepoint siginfo arguments as scalar + net: rename netns_local to netns_immutable + net: stmmac: fix dma mapping leak in stmmac_tso_xmit() + drm/virtio: Use drm_gem_plane_helper_prepare_fb() + drm/virtio: Add a helper to map and note the dma addrs and lengths + firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor + firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation + pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI + bpf: Remove migrate_{disable|enable} in bpf_obj_free_fields() + dm-integrity: replace forgeable discard filler with a keyed sector marker + perf/x86/intel/uncore: Fix uncore_box ref/unref ordering + xfs: remove unused trace event xfs_dqreclaim_dirty + ublk: fix dead loop when canceling io command + s390/kvm: Mask extra bits from program interrupt code + scsi: ufs: qcom : Fix NULL pointer dereference in ufs_qcom_setup_clocks + accel/ivpu: Fix race condition when mapping dmabuf + KVM: SEV: Drop FOLL_WRITE for encrypted region registration + net: Fix wild-memory-access in __register_pernet_operations() when CONFIG_NET_NS=n. + media: verisilicon: Fix kernel panic due to __initconst misuse + soc/tegra: pmc: Document tegra_pmc.syscore field + soc/tegra: pmc: Add kerneldoc for wake-up variables + i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring + sched/psi: Create the psimon kthread outside of cgroup_mutex + ocfs2: use correct endian in ocfs2_dinode_has_extents + s390/zcrypt: Fix memory leak with CCA cards used as accelerator + EDAC/igen6: Fix the flood of invalid error reports + netfilter: ctnetlink: do not expose expectation DEAD flag + EDAC/igen6: Fix NULL pointer dereference + Revert "esp: do not unref managed frag pages in esp_ssg_unref()" + mm: constify testing page/folio flags + mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback + PM: sleep: Unblock runtime PM when device prepare fails + soundwire: intel_auxdevice: remove redundant assignment to variable link_flags + soundwire: intel_auxdevice: Fix system suspend/resume handling + gpiolib: Allow to use setters with return value for output-only gpios + gpiolib: initialize return value in gpiochip_set_multiple() + i3c: master: svc: Fix missed IBI after false SLVSTART on NPCM845 + i3c: master: svc: Fix npcm845 FIFO_EMPTY quirk + i3c: master: svc: Fix i3c_master_get_free_addr return check + tracing: Fix ring_buffer_read_page_size() kernel-doc + tracing: Fix comment in tracing_buffers_splice_read() + dm-integrity: fix buffer overflow with keyed discard + wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses" + UBUNTU: Upstream stable to v6.6.160, v6.12.114 -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2172887 Title: Noble update: upstream stable patchset 2026-11-03 Status in linux package in Ubuntu: Invalid Status in linux source package in Noble: In Progress Bug description: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-11-03 Ported from the following upstream stable releases: v6.6.160, v6.12.114 from git://git.kernel.org/ xfrm: prevent policy_hthresh.work from racing with netns teardown Bluetooth: btqcomsmd: Convert to platform remove callback returning void ieee802154: cc2520: fix FIFOP work use-after-free openvswitch: prepare for stolen verdict coming from conntrack and nat engine perf/x86/intel: Update event constraints and cache_extra_regsfor ADL perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification scsi: lpfc: Define lpfc_dmabuf type for ctx_buf ptr net: add and use skb_get_hash_net usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41 drm/amd/display: Mark DCE 6.4 as not APU erofs: avoid infinite loops due to corrupted subpage compact indexes erofs: unify lcn as u64 for 32-bit platforms iio: adc: axp288: Add TS bias override for Haier HV103H HID: core: introduce hid_safe_input_report() HID: uhid: convert to hid_safe_input_report() netfilter: nft_set_pipapo: restore cloned mapping table memcg accounting pmdomain: rockchip: propagate subdomain add errors iio: light: Drop ROHM BU27034 UBUNTU: [Config] remove CONFIG_ROHM_BU27034 dlm: validate length in dlm_search_rsb_tree HID: steam: Clean up locking ip6_gre: remove obsolete ERSPAN PMTU update mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge ALSA: pcm: oss: Fix setup list UAF on proc write error ALSA: mixer: oss: Add card disconnect checkpoints net: team: rename team to team_core for linking net: team: Remove unused team_mode_op, port_enabled net: team: Rename port_disabled team mode op to port_tx_disabled net: team: fix NULL pointer dereference in team_xmit during mode change net: team: stop reusing skb after queue override Bluetooth: hci_sync: Fix command skb lifetime during scan setup Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex drm/vmwgfx: validate pitch coming from userspace namespace: don't inherit MNT_UMOUNT in clone_mnt() namespace: check the mounts before reading their parents in pivot_root() net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ scsi: ch: Do not keep references to data transfer element devices scsi: ufs: mcq: Remove unused parameters scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe() scsi: ufs: core: Add debug log for MCQ command timeout scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock() scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() drm/vc4: Fix firmware reference leak in vc4_drm_bind() namespace: unhash a dentry before detaching the mounts on it namespace: check the target before walking it in do_mount_setattr() fcntl: refuse F_SET_RW_HINT on an immutable inode namespace: handle mount locking for automounts correctly tty: add break_wait kernel-doc net: nexthop: Have all NH notifiers carry NH ID net: nexthop: Increase weight to u16 drm/amdgpu: change vm->task_info handling bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro() ice: Don't process extts if PTP is disabled ice: Fix improper extts handling gve: Account for stopped queues when reading NIC stats serial: sc16is7xx: fix TX fifo corruption scsi: lpfc: Fix failure to delete vports when discovery is in progress scsi: lpfc: Remove shost_lock protection for fc_host_port shost APIs scsi: lpfc: Change nlp state statistic counters into atomic_t scsi: lpfc: Protect vport fc_nodes list with an explicit spin lock scsi: lpfc: Change lpfc_vport fc_flag member into a bitmask l2tp: prevent possible tunnel refcount underflow fuse: Fix missing FOLL_PIN for direct-io udmabuf: change folios array from kmalloc to kvmalloc udmabuf: fix memory leak on last export_udmabuf() error path PCI: imx6: Fix suspend/resume support on i.MX6QDL RDMA/siw: Remove direct link to net_device mm: clear uffd-wp PTE/PMD state on mremap() btrfs: do proper folio cleanup when run_delalloc_nocow() failed btrfs: do proper folio cleanup when cow_file_range() failed ax25: Remove broken autobind RISC-V: KVM: Teardown riscv specific bits after kvm_exit wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info wifi: ath12k: fix incorrect TID updation in DP monitor status path wifi: ath12k: Avoid explicit type cast in monitor status parse handler wifi: ath12k: Avoid memory leak while enabling statistics perf: Fix hang while freeing sigtrap event smb: client: allocate crypto only for primary server smb: client: fix UAF in decryption with multichannel ublk: fix handling recovery & reissue in ublk_abort_queue() fs/ntfs3: Use function file_inode to get inode from file fs/ntfs3: Separete common code for file_read/write iter/splice fs/ntfs3: Keep write operations atomic drm/amd/display: prevent hang on link training fail kasan: avoid sleepable page allocation from atomic context clk: sunxi-ng: h616: Reparent CPU clock during frequency changes clk: sunxi-ng: h616: Reparent GPU clock during frequency changes dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn virtio: make virtio_bus const virtio: hookup irq_get_affinity callback virtio: break and reset virtio devices on device_shutdown() wifi: iwlwifi: don't warn when if there is a FW error coresight: holding cscfg_csdev_lock while removing cscfg from csdev riscv: save the SR_SUM status over switches s390/mm: Fix in_atomic() handling in do_secure_storage_access() drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() rv: Use strings in da monitors tracepoints wifi: iwlwifi: return ERR_PTR from opmode start() wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() net/sched: Fix backlog accounting in qdisc_dequeue_internal mm/smaps: fix race between smaps_hugetlb_range and migration crypto: x86/aegis128 - eliminate some indirect calls crypto: x86/aegis128 - optimize length block preparation using SSE4.1 crypto: x86/aegis128 - improve assembly function prototypes crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT crypto: x86/aegis - Add missing error checks ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog wifi: mt76: mt7915: fix list corruption after hardware restart mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() smb: client: let recv_done verify data_offset, data_length and remaining_data_length dm-verity: provide dma_alignment limit in io_hints dm-stripe: limit chunk_sectors to the stripe size iommu/s390: Make attach succeed when the device was surprise removed bpf: improve error message for unsupported helper bpf: add a get_helper_proto() utility function bpf: Check the helper function is valid in get_helper_proto RISC-V: KVM: Write hgatp register with valid mode bits tcp_metrics: use dst_dev_net_rcu() crypto: hisilicon/qm - request reserved interrupt for virtual function net: use dst_dev_rcu() in sk_setup_caps() ASoC: Intel: avs: Do not share the name pointer between components tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() mlx5: Fix default values in create CQ drm/amdgpu: fix gpu page fault after hibernation on PF passthrough scsi: ufs: qcom : Refactor phy_power_on/off calls scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) scsi: imm: Fix use-after-free bug caused by unfinished delayed work gfs2: Prevent recursive memory reclaim coresight: ETR: Fix ETR buffer use-after-free issue wifi: ath12k: Fix MSDU buffer types handling in RX error path scsi: qla2xxx: Clear cmds after chip reset Input: alps - fix use-after-free bugs caused by dev3_register_work Input: lkkbd - disable pending work before freeing device usb: gadget: Support already-mapped DMA SGs usb: gadget: functionfs: Factorize wait-for-endpoint code functionfs, gadgetfs: use simple_recursive_removal() functionfs: fix the open/removal races wifi: mac80211: don't WARN for connections on invalid channels PCI: endpoint: Add missing NULL check for alloc_workqueue() bpf: Mark bpf_refcount field as unique staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths of: unittest: Fix memory leak in unittest_data_add() ALSA: usb-audio: Prevent excessive number of frames tcp: secure_seq: add back ports to TS offset cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN fs: super_set_uuid() ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION drm/amdgpu: Remove usage of the deprecated ida_simple_xx() API drm/amdgpu: prevent immediate PASID reuse case cxl/port: Fix use after free of parent_port in cxl_detach_ep() ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() s390/mm: Add missing secure storage access fixups for donated memory KVM: SEV: Use long-term pin when registering encrypted memory regions KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock usb: gadget: f_hid: don't call cdev_init while cdev in use rxrpc: proc: size address buffers for %pISpc output net: lan966x: fix page pool leak in error paths Bluetooth: hci_event: move wake reason storage into validated event handlers bpf: Fix incorrect pruning due to atomic fetch precision tracking Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists mpls: add seqcount to protect the platform_label{,s} pair HID: core: Add reserved item tag for main items HID: rate-limit hid_warn to prevent log flooding HID: core: Mitigate potential OOB by removing bogus memset() ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() types: move struct rcuwait into types.h irqwork: Move data struct to a types header srcu: Use irq_work to start GP in tiny SRCU btrfs: tree-log: don't use token set/get accessors in fill_inode_item() btrfs: fix zero size inode with non-zero size after log replay fs/ntfs3: Accumulated refactoring changes ntfs3: fix circular locking dependency in run_unpack_ex wifi: iwlwifi: fix 22000 series SMEM parsing wifi: rtw89: pci: validate sequence number of TX release report team: avoid NETDEV_CHANGEMTU event when unregistering slave drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels drm/amdgpu: Skip vcn poison irq release on VF btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue i3c: mipi-i3c-hci: Fix race in DMA ring dequeue ASoC: amd: acp-mach-common: Add missing error check for clock acquisition net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ iommu/vt-d: Clear Present bit before tearing down PASID entry bpf: Fix tcx/netkit detach permissions when prog fd isn't given btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation net: stmmac: fix oops when split header is enabled gfs2: fix memory leaks in gfs2_fill_super error path KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 dm-verity-fec: fix reading parity bytes split across blocks (take 3) spi: microchip-core-qspi: control built-in cs manually riscv: kvm: fix vector context allocation leak f2fs: fix fsck inconsistency caused by FGGC of node block RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() spi: mpc52xx: fix controller deregistration drm/amd/display: Fix dc_link NULL handling in HPD init coresight: tmc-etr: Fix race condition between sysfs and perf mode selinux: allow multiple opens of /sys/fs/selinux/policy netfilter: nf_tables: use list_del_rcu for netlink hooks Revert "net/smc: Introduce TCP ULP support" tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() sched/psi: fix race between file release and pressure write netfilter: nat: use kfree_rcu to release ops ice: fix double-free of tx_buf skb f2fs: fix data loss caused by incorrect use of nat_entry flag f2fs: avoid reading already updated pages during GC greybus: raw: fix use-after-free on cdev close iommu/amd: Fix clone_alias() to use the original device's devid net: pull headers in qdisc_pkt_len_segs_init() powerpc/64s: Fix unmap race with PMD migration entries powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy vdpa: use generic driver_override infrastructure PCI: use generic driver_override infrastructure fs/mbcache: cancel shrink work before destroying the cache staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction Staging: rtl8723bs: Remove dead code from _rtw_free_network() Staging: rtl8723bs: Delete dead code from update_current_network() staging: rtl8723bs: clean up redundant & parentheses staging: rtl8723bs: fix buffer over-read in rtw_update_protection wifi: fix leak if split 6 GHz scanning fails l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() btrfs: only release the dirty pages io tree after successful writes net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind net: mana: Guard mana_remove against double invocation wifi: mt76: mt7921: Place upper limit on station AID drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() drm/msm: always recover the gpu fbdev: omap2: fix inconsistent lock returns in omapfb_mmap fbdev: omap2: fix use-after-free in omapfb_mmap f2fs: read COW data with the original inode during atomic write gcov: use atomic counter updates to fix concurrent access crashes drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring drm/amdgpu: fix amdgpu_hmm_range_get_pages usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close net/handshake: Drain pending requests at net namespace exit ethtool: rss: fix indir_table and hkey leak on get_rxfh failure cgroup/rstat: validate cpu before css_rstat_cpu() access hwmon: (lm90) Stop work before releasing hwmon device netfilter: bridge: eb_tables: close module init race netfilter: ebtables: move to two-stage removal scheme mm/util: Introduce kmemdup_array() netfilter: Use kmemdup_array instead of kmemdup for multiple allocation netfilter: x_tables: allow initial table replace without emitting audit log message netfilter: x_tables: allocate hook ops while under mutex wifi: mac80211: fix missing RX bitrate update for mesh forwarding path wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb erofs: fix metabuf leak in inode xattr initialization drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() hwmon: (lm90) Add lock protection to lm90_alert smb/client: fix chown/chgrp with SMB3 POSIX Extensions ksmbd: validate NTLMv2 response before updating session key ksmbd: prevent path traversal bypass by restricting caseless retry ALSA: hda/cs35l41: Fix firmware load work teardown net/handshake: Take a long-lived file reference at submit KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state LoongArch: Move jump_label_init() before parse_early_param() drm/vc4: Shut down BO cache timer before teardown drm/amdgpu: Use dbg level for VBIOS check messages drm/amdgpu: Add wrapper for freeing vbios memory drm/amdgpu: Release VFCT ACPI table reference drm/i915/mst: limit DP MST ESI service loop drm/i915/gt: Fix NULL deref on sched_engine alloc failure drm/amdkfd: Check bounds on CRIU restore queue type and mqd size cifs: prevent readdir from changing file size due to stale directory metadata cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths tipc: serialize udp bearer replicast list updates firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() wifi: cfg80211: use wiphy work for socket owner autodisconnect wifi: mac80211: refactor populating mesh related fields in sinfo wifi: cfg80211: add link_station_info structure to support MLO statistics wifi: mac80211: defer link RX stats percpu free to RCU RDMA/irdma: Prevent user-triggered null deref on QP create xfrm: fix stale skb->prev after async crypto steals a GSO segment LoongArch: Fix address space mismatch in kexec command line lookup net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains ovl: check access to copy_file_range source with src mounter creds s390/zcrypt: Fix buffer over-read in cca_cipher2protkey wifi: ieee80211: validate MLE common info length mmc: vub300: fix use-after-free on probe failure dm-verity: fix buffer overflow in FEC calculation ocfs2: correct l_next_free_rec in online check ocfs2: add suballoc slot check in ocfs2_validate_inode_block() ocfs2: validate i_refcount_loc when refcount flag is set ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec fs: Remove NTFS classic UBUNTU: [Config] remove classic NTFS options KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() net/liquidio: drop cached VF pci_dev LUT Bluetooth: 6lowpan: avoid untracked enable work net/mlx5e: Fix publication race for priv->channel_stats[] afs: Fix reinitialisation of the inode, in particular ->lock_work xen/pvcalls: bound backend response req_id before indexing rsp[] sctp: fix addr_wq_timer race in sctp_free_addr_wq() hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() sctp: add INIT verification after cookie unpacking tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() bpf: net: netfilter: drop dead NULL checks bpf: Guard conntrack opts error writes md/raid10: fix writes_pending leak on write request failures md/raid1: fix writes_pending and barrier reference leaks on write failures soundwire: fix bug in sdw_add_element_group_count found by syzkaller RDMA/irdma: Replace waitqueue and flag with completion RDMA/bnxt_re: Avoid repeated requests to allocate WC pages RDMA/bnxt_re: Initialize dpi variable to zero sockmap: Fix use-after-free in udp_bpf_recvmsg() ALSA: seq: fifo: Use guard() for locking ALSA: seq: Clean up fifo locking with guard ALSA: seq: avoid stale FIFO cells during resize net: watchdog: fix refcount tracking races bnxt: fix head underflow on XDP head-grow cxl/region: Block region delete during region creation ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT ixgbe: do not configure xps for XDP queues bpf: Reject sleepable BPF_LSM_CGROUP programs at load time bpf: Clear rb node linkage when freeing bpf_rb_root ocfs2: add extra consistency checks for chain allocator dinodes ocfs2: validate fast symlink target during inode read vhost: correct misleading printing information vhost: move smp_rmb() into vhost_get_avail_idx() wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() md/raid1,raid10: fix deadlock in read error recovery path ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data OPP: Fix race between OPP addition and lookup wifi: ath11k: cancel SSR work items during PCI shutdown s390/zcrypt: Close speculative mem read possibility octeontx2-af: Block VFs from clobbering special CGX PKIND state Bluetooth: ISO: hold sk properly in iso_conn_ready net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx btrfs: skip global block reserve accounting for rescue mounts mm/page_table_check: skip special zero mappings eventfs: Use children field for rcu head and add memory barriers selftests: tls: add test with a partially invalid iov selftests: tls: add rekey tests tls: rx: restore msg_iter before TLS 1.3 optimistic retry watchdog: at91sam9_wdt: prevent timer rearm during teardown s390/ism: Fix UAF of sba and ieq during ism_dev_exit() netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() hwmon: (pmbus) Fix type confusion in notification logic vhost_iotlb: bound map allocation in add_range bpf: Fix netns reference imbalance in conntrack kfuncs btrfs: lzo: reject inline extents without valid headers soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock firewire: ohci: fix NULL pointer dereference in ar_context_release ipvs: revalidate ihl to prevent out-of-bounds access sctp: validate cookie AUTH state before use scsi: core: pair EH runtime PM get and put tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() coresight: ete: Always save state on power down ALSA: seq: oss: Serialize readq reset state with q->lock btrfs: lzo: reject compressed segment that overflows the compressed input netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag EDAC/igen6: Fix call trace due to missing release() scsi: hisi_sas: Add slave_destroy interface for v3 hw cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size netfilter: nf_conntrack_expect: use conntrack GC to reap expectations Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks dmaengine: idxd: fix double free of wq, engine, and group structs bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length drm/amdkfd: Add bounds check for CRAT subtype length Bluetooth: ISO: zero the sockaddr before returning it in getname fbdev: Wrap user-invoked calls to fb_set_var() in helper RDMA/rxe: Remove redundant scheduling of rxe_completer RDMA/rxe: Merge request and complete tasks tipc: avoid busy looping in tipc_exit_net() NTB: core: Add .get_dma_dev() callback to ntb_dev_ops NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers ntb: Store original DMA address for future release tap: Keep hdr_len in tap_get_user() net: tap: fix wrong transport_header when sending VLAN-tagged frame io_uring: defer eventfd signaling when queued from a wakeup handler wifi: iwlwifi: dvm: pair transport op-mode enter/leave wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() power: supply: lp8788: Use devm_power_supply_register() helper filelock: split common fields into struct file_lock_core lockd: adapt to breakup of struct file_lock svcrdma: Refactor the creation of listener CMA ID sunrpc: xprtrdma: Use ERR_CAST() to return svcrdma: Reject Read lists that exceed the page budget svcrdma: Handle ADDR_CHANGE CM event properly SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 ext2: Fix lost inode updates for IS_SYNC inodes smb: client: reject a tree connect response whose byte count is too small smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() cifs: call pagecache_isize_extended() in cifs_setsize() when extending ceph: cap delegated inode count in ceph_parse_deleg_inos() ceph: fix UAF in check_new_map() on session freed during unlock nfsd: fix stale s2s_cp_stateids IDR entry for async COPY nfsd: split sc_status out of sc_type lockd, nfsd: RCU-protect nlmsvc_ops dispatch nfsd: Pass 'cred' instead of 'rqstp' to some functions. mm/mglru: fix and remove redundant unevictable folio handling ksmbd: fix uninitialized symbol 'share' in smb2_tree_connect() ksmbd: fix tree connection use-after-free in smb2_tree_connect() drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram drm/amdkfd: Fix error path at svm_migrate_copy_to_ram drm/amdkfd: Add TLB flush after MES queue eviction/suspension drm/amdgpu: force complete the KIQ ring fences on reset f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() LoongArch: BPF: Refactor jump offset calculation in tail call KVM: s390: Fix memory corruption by not reinjecting CK machine checks mm/huge_memory: transfer the pmd dirty bit to the folio on zap netfilter: nf_tables: skip double clone set expressions on element insert net/sched: act_ife: Only operate on Ethernet frames octeontx2-vf: fix workqueue and netdev race in probe/remove Bluetooth: do not leak an hci_conn when a second LE connect is rejected Bluetooth: L2CAP: access chan->conn safely in get/setsockopt Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition net/sched: account classifier filter allocations to memcg NFSv4.1: zero referring call lists before decoding vxlan: fix reading neigh ha net: bridge: arp/nd proxy: fix reading neigh ha ip6mr: do not clone dst in ip6mr_cache_report() ALSA: mtpav: shut down output timer before card teardown filelock: add some new helper functions NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers ksmbd: scope session state changes to bound connections ksmbd: detach blocked lock requests before freeing ksmbd: safely discard unregistered deferred locks erofs: fix interlaced ztailpacking pclusters ksmbd: defer publishing granted locks to prevent UAF/double-free race ksmbd: serialize oplock close with pending break ownership ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() apparmor: fix deadlock in complain-mode change_hat blk-cgroup: delay freeing policy data after rcu grace period blk-iocost: clear delay state when freeing policy data blk-iolatency: clear delay state when freeing policy data ocfs2: validate DIO orphan slot during inode read ocfs2: validate orphan slot during inode read nvmet: fix max_qid race between configfs and controller allocation clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type amt: Don't support cross-netns setup. NFS: Return a delegation the client fails to record bpf: Fix mmap_lock leak in irq_work path Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() btrfs: check if root is readonly when setting posix acl btrfs: always wait for ordered extents to avoid OE races btrfs: defrag: fix deadlock between defrag and delalloc space reservation scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable drm/amd/display: Resize MST HDCP per-connector arrays to 32 bpf: Clear buf on error in __bpf_get_task_stack ocfs2/heartbeat: fix slot mapping rollback leaks on error paths ocfs2: o2hb: quiesce negotiate handlers and timeout work thermal: hwmon: Remove hwmon class device along with its parent ocfs2: validate inline xattrs during inode block validation ublk: check import_ubuf() return value blk-cgroup: fix race between policy activation and blkg destruction HID: steam: Reject short reads HID: logitech-hidpp: Fix FF device cleanup on init failure tty: skip cdev_del() when no cdev is registered serial: core: clear freed pointers on uart_register_driver() failure serial: core: do fallible allocations before the console can be registered wifi: cfg80211: stop PMSR before P2P and NAN teardown wifi: brcmfmac: fix P2P action frame handling without device vif wifi: nl80211: check link is beaconing for color change wifi: nl80211: clean up color-change beacon data on errors arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry wifi: mt76: cancel reset and rc work on device unregister wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER wifi: mt76: mt7915: allocate vif wcid in the same range as stations wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface() wifi: mt76: mt7915: unwind state on add_interface failure wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() PCI: Make pci_match_one_device() match on ID instead of device PCI: Fix dyn_id add TOCTOU PCI: Fix UAF when probe runs concurrent to dyn ID removal clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path scsi: ufs: core: Convert string descriptor format macros to enum scsi: ufs: core: Validate string descriptors pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip bpf: Fix WARNING in bpf_tracing_link_release ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() bpf: remove unused parameter in bpf_jit_binary_pack_finalize bpf: Zero queue and stack outputs on lock failure drm/sched: Use struct for drm_sched_init() params drm/msm: Only fini scheduler after successful init firmware: arm_scmi: Fix SCMI device destroy lifetimes RDMA/rvt: Return NULL after port allocation failure esp: do not unref managed frag pages in esp_ssg_unref() platform/x86: asus-wmi: fix resource leaks on probe failure usb: gadget: uac: validate rate list length before storing bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max platform/x86: lg-laptop: Fix LED resource handling platform/x86: dell-wmi-base: Fix handling of ultra performance key bpf: Reject writes through untrusted BTF pointers time/namespace: Validate nanosecond field in proc_timens_set_offset() bpf: Reject MEM_ALLOC BTF accesses past object bounds cgroup/cpuset: introduce cpuset-v1.c dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout drm/amd/display: Fix dangling pointer in CRTC reset function drm/amd/display: Fix dangling pointer in plane reset function i3c: master: Fix recursive locking during device registration mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() nfsd: convert nfsd_net boolean flags to unsigned long flags word ACPI: bus: Introduce acpi_bus_get_primary_device() powerpc/xive: add error return value to xive_smp_probe() powerpc/xive: propagate IPI init errors to prevent use-after-free remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 ksmbd: remove redundant DACL check in smb_check_perm_dacl ksmbd: fix maximum allowed access checks drm/amdkfd: fix SMI event cross-process information leak drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq wifi: iwlwifi: mvm: fix P2P-Device binding handling RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() virt: acrn: Fix irqfd use-after-free during eventfd shutdown driver core: Avoid warning when removing a device while its supplier is unbinding serial: 8250: invert serial8250_register_8250_port() CIR condition tty: serial: 8250: protect against NULL uart->port.dev in register drm/amdgpu: Remove unused amdgpu_i2c functions drm/amdgpu/atombios: drop empty function drm/amdgpu: rework i2c init and fini drm/amdgpu: Bound GPIO I2C table entry count from VBIOS pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction genirq/proc: Size interrupt directory names for 10-digit interrupt numbers bpf: Mark raw_tp arguments with PTR_MAYBE_NULL net: dsa: b53: do not enable EEE on bcm63xx ACPI: platform: Use acpi_bus_get_primary_device() drm/msm: Recover HW before retire hung submit ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS RDMA/efa: Fix use of completion ctx after free ASoC: qcom: q6asm: handle the responses after closing ASoC: qcom: q6asm: drop DSP responses for closed data streams media: hantro: Disable multicore support media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC hwrng: core - use RCU and work_struct to fix race condition KVM: SVM: Add missing save/restore handling of LBR MSRs ceph: fix num_ops off-by-one when crypto allocation fails greybus: raw: fix use-after-free if write is called after disconnect erofs: fix use-after-free on sbi->sync_decompress net/handshake: hand off the pinned file reference to accept_doit cxl/region: Resolve region deletion races md/raid1,raid10: fix bio accounting for split md cloned bios md/raid1,raid10: fix error-path detection with md_cloned_bio() iommu: Pass domain to remove_dev_pasid() op nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net ocfs2: validate external xattr entries when reading metadata fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid ALSA: usx2y: Use standard print API perf/x86/intel: Prevent drain_pebs() reentry net/mlx5e: Move representor vnic reporter to eswitch devlink port Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() vhost: invalidate vring access on IOTLB transitions vduse: validate virtqueue alignment virtio_ring: fix stale descriptor flags after a failed packed add iommu/amd: Do not reallocate GA log buffers on resume bpf: mark a NULL call argument precise bpf: Preserve inner map identity in callback frames bpf: Mark NULL kptr stores precise bpf: Don't infer non-NULL from a pointer with an unbounded offset nvme_core: scan namespaces asynchronously bpf: Mark syscall helpers as sleepable erofs: disable LZ4 rolling decompression for now net: plumb extack in __dev_change_net_namespace() net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). btrfs: zstd: fix lost wakeup when waiting for a workspace bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge ipv6: mcast: use rcu_assign_pointer() for __rcu list updates smb/client: invalidate fscache for fallocate range operations smb/client: fix stale page cache in insert/collapse range bpf: check_cond_jmp_op(): properly infer if register is null drm/gud: validate GUD_ROTATION_0 is present in supported rotations drm/virtio: use the DMA API for resource backing on Xen smb/server: fix tree connection leak in smb2_tree_connect() r8169: remove original workaround for RTL8125 broken rx issue ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 Revert "ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev()" Revert "mm/filemap: avoid buffered read/write race to read inconsistent data" xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock xfs: catch stale AGF/AGF metadata xfs: rearrange code in xfs_buf_item.c xfs: factor out stale buffer item completion xfs: fix unmount hang with unflushable inodes stuck in the AIL bpf, sockmap: Account for receive queue in FIONREAD without a verdict program ksmbd: fix heap out-of-bounds write in krb5_authenticate() KVM: x86: Use active memslots for the per-vCPU MMIO cache spi: mpc52xx: clean up interrupt handling iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() xfs: avoid dquot buffer pin deadlock drm/amd: Create a device link between APU display and XHCI devices ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands wifi: mt76: connac: tolerate inactive BSS deactivation drm/vmwgfx: Stop using dev_private to store driver data. net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop riscv: Use offset_in_page() in text patching functions riscv: patch: Avoid early phys_to_page() riscv: patch: fix handling of bpf-jit execmem addresses drm/vc4: Use video aperture helpers smb: client: improve compound padding in encryption smb: client: get rid of bounds check in SMB2_ioctl_init() smb: client: fix compound alignment with encryption drm/i915/display: support struct intel_atomic_state in to_intel_display() drm/i915/display: pass display to intel_crtc_for_pipe() drm/i915/vga: Convert VGA code to intel_display drm/i915/display: convert I915_STATE_WARN() to struct intel_display drm/i915/de: register wait function renames drm/i915: add generic __to_intel_display() drm/i915/display: accept either i915 or display for feature tests drm/i915/de: allow intel_display and drm_i915_private for de functions drm/i915/gmbus: convert to struct intel_display drm/i915/crt: convert to struct intel_display drm/i915: Grab intel_display from the encoder to avoid potential oopsies f2fs: quota: fix to avoid warning in dquot_writeback_dquots() perf/dwc_pcie: Add support for QCOM vendor devices perf/dwc_pcie: Qualify RAS DES VSEC Capability by Vendor, Revision perf/dwc_pcie: fix duplicate pci_dev devices ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd wifi: ath12k: convert struct ath12k_sta::update_wk to use struct wiphy_work wifi: ath12k: prepare vif data structure for MLO handling wifi: ath12k: Fix memory leak due to multiple rx_stats allocation mm: fix uprobe pte be overwritten when expanding vma riscv: Enable cbo.zero only when all harts support Zicboz riscv: Add support for per-thread envcfg CSR values s390/kvm: Remove kvm_arch_fault_in_page() s390/mm: Simplify get_fault_type() s390/mm: Get rid of fault type switch statements platform/x86/amd/pmf: Switch to platform_get_resource() and devm_ioremap_resource() platform/x86/amd: pmf: Use device managed allocations drm/rockchip: vop2: Consistently use dev_err_probe() drm/rockchip: vop2: Register the primary plane and overlay plane separately rv: Remove trailing whitespace from tracepoint string mm/mremap: fix WARN with uffd that has remap events disabled iommu/s390: handle IOAT registration based on domain iommu/s390: set appropriate IOTA region type drm/xe: Don't allow evicting of BOs in same VM in array of VM binds ASoC: Intel: avs: Use topology information for endpoint numbers sysfs: check visibility before changing group attribute ownership amd/amdkfd: enhance kfd process check in switch partition RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET net/mlx5: Store the global doorbell in mlx5_priv net/mlx5e: Prepare for using different CQ doorbells net: vxlan: prevent NULL deref in vxlan_xmit_one wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks accel/ivpu: Allow to import single buffer into multiple contexts accel/ivpu: Rework bind/unbind of imported buffers accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() accel/qaic: Add config structs for supported cards net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels idpf: fix error handling in the init_task on load riscv: trace: fix snapshot deadlock with sbi ecall bpf: Fix exception exit lock checking for subprogs drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register dm: limit swapping tables for devices with zone write plugs net: use synchronize_rcu_expedited in cleanup_net() net: Factorise setup_net() and cleanup_net(). net: Add ops_undo_single for module load/unload. net: Add ->exit_rtnl() hook to struct pernet_operations. wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit bnxt_en: set backing store type from query type xfs: remove bp->b_error check in xfs_attr3_root_inactive xfs: factor out xfs_attr3_node_entry_remove xfs: close crash window in attr dabtree inactivation drm/amd/display: Add a function for checking tmds mode drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 media: chips-media: wave5: Fix Null reference while testing fluster btrfs: remove 'reserved' argument from btrfs_pin_extent() md raid: fix hang when stopping arrays with metadata through dm-raid KVM: Rename symbols related to enabling virtualization hardware KVM: Export hardware virtualization enabling/disabling functions syscore: Pass context data to callbacks wifi: iwlwifi: mvm: don't send a 6E related command when not supported rxrpc: kdoc: Update function descriptions and add link from rxrpc.rst rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() nouveau/gsp: drop WARN_ON in ACPI probes KVM: x86: Rename "governed features" helpers to use "guest_cpu_cap" doc: Clarify use of slab constructors and SLAB_TYPESAFE_BY_RCU refcount: provide ops for cases when object's memory can be reused wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync wifi: mt76: Fix memory leak destroying device iommu/vt-d: Avoid NULL pointer dereference or refcount corruption drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED wifi: mt76: add wcid publish check in mt76_sta_add netfs: Fix leak of request in netfs_write_begin() error handling netfs: Fix zeropoint update where i_size > remote_i_size KVM: guest_memfd: Treat memslot binding offset+size as unsigned values KVM: x86: Drop superfluous kvm_lapic_set_base() call when setting APIC state KVM: x86: Move kvm_set_apic_base() implementation to lapic.c (from x86.c) KVM: x86: Rename APIC base setters to better capture their relationship KVM: x86: Move update_cr8_intercept() to lapic.c KVM: x86: Unconditionally recompute CR8 intercept on PPR update media: stm32: dcmipp: use v4l2_subdev_is_streaming media: stm32: dcmipp: replace s_stream with enable/disable_streams media: stm32-dcmipp: Return queued buffers on start_streaming() failure idpf: fix max_vport related crash on allocation error during init LoongArch: BPF: Zero-extend signed ALU32 div/mod results bnxt_en: Handle partially initialized auxiliary devices drm/xe/guc: Keep scheduler timeline name alive Bluetooth: hci_sync: extend conn_hash lookup critical sections bpf: Disable migration when destroying sock storage bpf: Disable migration when cloning sock storage rcu: add rcu_read_lock_dont_migrate() bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() drm/amd/display: use kvzalloc to allocate struct dc drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size wifi: mac80211: validate extension-frame layout before RX ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD mmc: vub300: Use devm_mmc_alloc_host() helper mmc: vub300: fix use-after-free on disconnect mmc: vub300: rename probe error labels RDMA/bnxt_re: Free CQ toggle page after firmware teardown nvmet-tcp: check return value of nvmet_tcp_set_queue_sock s390/ap: Move response_type struct into ap_msg struct s390/ap/zcrypt: Rework AP message buffer allocation s390/ap: Introduce ap message buffer pool s390/ap/zcrypt: New xflag parameter s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code s390/zcrypt: Rework domain processing within zcrypt device driver afs: Fix UAF when sending a message Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback Bluetooth: ISO: lock sk in iso_connect_ind xsk: drain continuation descs after overflow in xsk_build_skb() xsk: provide sufficient space in pool->tx_descs xsk: reclaim invalid Tx descriptors in ZC batch path net: ibm: emac: use devm_platform_ioremap_resource net: ibm: emac: use platform_get_irq net: emac: Fix NULL pointer dereference in emac_probe EDAC/igen6: Initialize edac_op_state according to the configuration data EDAC/igen6: Add polling support EDAC/igen6: Skip absent memory controllers soc: xilinx: Fix race condition in event registration idpf: add idpf_virtchnl.h idpf: bound interrupt-vector register fill to the allocated array btrfs: initialize inode mapping flags for cached inodes svcrdma: Add Write chunk WRs to the RPC's Send WR chain svcrdma: wake sq waiters when the transport closes svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths drm/amdkfd: Fix partial migrate issue drm/amdkfd: return migration pages from copy function Revert "drm/amdkfd: return migration pages from copy function" drm/amdkfd: return migration pages from copy function - again drm/amdgpu: force complete the MES ring fences on reset KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables netfilter: nf_tables: prefer nft_trans_elem_alloc helper netfilter: nf_tables: add nft_trans_commit_list_add_elem helper netfilter: nf_tables: prepare for multiple elements in nft_trans_elem structure net_sched: sch_fq: add three drop_reason net/sched: add qstats_cpu_drop_inc() helper xsk: honor XDP_TX_METADATA in zero-copy path dpll: fix NULL deref in dpll_device_ops() during teardown race bpf: Compare iterator types during state pruning apparmor: fix unconfined user namespace restriction forced stack iommu/vt-d: Flush context cache with correct SID when tearing down aliases btrfs: zoned: don't clobber the extent buffer when zeroing it out wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed bpf: Reject >8 byte return values on return-reading trampoline paths drm/msm: don't tear down KMS twice when KMS init fails mm/hugetlb: refactor code around vmemmap_walk mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier drm/amd/amdgpu: Update PF2VF Header drm/amdgpu: Update SRIOV Exchange Headers for RAS Telemetry Support wifi: iwlwifi: simplify nested if checks virt: acrn: Remove unused list 'acrn_irqfd_clients' PM: sleep: Use bool for all 1-bit fields in struct dev_pm_info PM: sleep: core: Synchronize runtime PM status of parents and children PM: sleep: core: Restrict power.set_active propagation PM: Rearrange documentation related to __pm_runtime_disable() PM: Block enabling of runtime PM during system suspend PM: runtime: Introduce pm_runtime_blocked() PM: sleep: Use DPM_FLAG_SMART_SUSPEND conditionally PM: sleep: Fix bit masking operation driver core: Add device_link_test() for testing device link flags gpiolib: make value setters have return values gpiolib: wrap gpio_chip::set() gpiolib: rework the wrapper around gpio_chip::set_multiple() gpiolib: introduce gpio_chip setters that return values pinctrl: mediatek: paris: don't double-check the GPIO number pinctrl: mediatek: paris: use new GPIO line value setter callbacks genirq/proc: Switch to lock guards genirq: Consistently use '%u' format specifier for unsigned int variables media: chips-media: wave5: Release m2m_ctx after Instance Removed from List i3c: master: svc: Fix npcm845 FIFO empty issue i3c: master: svc: Fix npcm845 invalid slvstart event i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 drm/amdgpu: skip the VMID 0 flush for VRAM tracing: Fix subbuf resize races with trace_pipe_raw readers bpf: Keep refcount_acquire nullable for borrowed RCU kptrs bpf: Reject legacy packet loads from callbacks bpf: Check ancestor frames for rbtree callbacks bpf: Mark signal tracepoint siginfo arguments as scalar net: rename netns_local to netns_immutable net: stmmac: fix dma mapping leak in stmmac_tso_xmit() drm/virtio: Use drm_gem_plane_helper_prepare_fb() drm/virtio: Add a helper to map and note the dma addrs and lengths firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI bpf: Remove migrate_{disable|enable} in bpf_obj_free_fields() dm-integrity: replace forgeable discard filler with a keyed sector marker perf/x86/intel/uncore: Fix uncore_box ref/unref ordering xfs: remove unused trace event xfs_dqreclaim_dirty ublk: fix dead loop when canceling io command s390/kvm: Mask extra bits from program interrupt code scsi: ufs: qcom : Fix NULL pointer dereference in ufs_qcom_setup_clocks accel/ivpu: Fix race condition when mapping dmabuf KVM: SEV: Drop FOLL_WRITE for encrypted region registration net: Fix wild-memory-access in __register_pernet_operations() when CONFIG_NET_NS=n. media: verisilicon: Fix kernel panic due to __initconst misuse soc/tegra: pmc: Document tegra_pmc.syscore field soc/tegra: pmc: Add kerneldoc for wake-up variables i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring sched/psi: Create the psimon kthread outside of cgroup_mutex ocfs2: use correct endian in ocfs2_dinode_has_extents s390/zcrypt: Fix memory leak with CCA cards used as accelerator EDAC/igen6: Fix the flood of invalid error reports netfilter: ctnetlink: do not expose expectation DEAD flag EDAC/igen6: Fix NULL pointer dereference Revert "esp: do not unref managed frag pages in esp_ssg_unref()" mm: constify testing page/folio flags mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback PM: sleep: Unblock runtime PM when device prepare fails soundwire: intel_auxdevice: remove redundant assignment to variable link_flags soundwire: intel_auxdevice: Fix system suspend/resume handling gpiolib: Allow to use setters with return value for output-only gpios gpiolib: initialize return value in gpiochip_set_multiple() i3c: master: svc: Fix missed IBI after false SLVSTART on NPCM845 i3c: master: svc: Fix npcm845 FIFO_EMPTY quirk i3c: master: svc: Fix i3c_master_get_free_addr return check tracing: Fix ring_buffer_read_page_size() kernel-doc tracing: Fix comment in tracing_buffers_splice_read() dm-integrity: fix buffer overflow with keyed discard wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses" UBUNTU: Upstream stable to v6.6.160, v6.12.114 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172887/+subscriptions