This bug was fixed in the package linux - 7.0.0-43.43 --------------- linux (7.0.0-43.43) resolute; urgency=medium * resolute/linux: 7.0.0-43.43 -proposed tracker (LP: #2171676) * HMC error triggers cascading PF resets and tears down RDMA connections (LP: #2167995) - RDMA/irdma: Suppress PF reset on HMC error * Loading certificate with --import enrolls it into the platform keyring instead of the machine keyring (LP: #2131181) - SAUCE: integrity: Load MokListRT certs into the machine keyring * Intel Bluetooth stops working on some cold boots on Dell systems (LP: #2170908) - Bluetooth: btintel_pcie: treat boot stage bit 12 as warning * Fix TI TAS2783 amplifier firmware load issue (LP: #2169023) - ASoC: tas2783-sdw: add firmware download status check * Dell XPS 13 9340: OV02C10 front camera image upside down (missing ipu- bridge DMI quirk) (LP: #2169185) - SAUCE: media: ipu-bridge: fix rotation quirk for XPS 13 9340/14 9440 * AMD system hangs on resume when a Thunderbolt dock is plugged in during s2idle (LP: #2168944) - platform/x86/amd: Stop counting intermediate cycles with metrics table * ath12k: WCN7850 MLO double DMA-unmap/free of REO queue buffer on firmware restart corrupts memory (needs upstream 4a1b53417739) (LP: #2169101) - wifi: ath12k: prepare REO update element only for primary link * amdkfd kernel crash when KFD procfs creation fails after execve (LP: #2168705) - drm/amdkfd: fix kernel crash on releasing NULL sysfs entry * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) - bnxt_en: fix DMA mapping length for padded small packets - fs: Free any excess xarray nodes in clear_inode() - net/mlx5e: Prevent stale XSK buffer release on refill retry - net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry - net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() - net: mana: Skip WQ object destruction for uninitialized RXQ - accel/amdxdna: Bound the sync_bo flush range to the BO size - net: dsa: mt7530: fix .get_stats64 sleeping in atomic context - ipv6: Fix redirect exception creation for UDP/RAW sockets - ipv4: validate checksum_start before completing checksum - rust_binder: reschedule node refcount update on thread exit - ipv4: stop PMTU walk when nexthop group shrinks - ipv4: stop exception dump when nexthop group shrinks - ipv4: stop route notification sizing when nexthop group shrinks - ipv4: do not warn on route notification size race - ipv6: do not warn on route notification size race - Input: ati_remote2 - fix type confusion in device attribute handlers - Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox - Input: xpad - add support for Corsair Novablade Pro - ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers - ALSA: hda/tas2781: Accept V1 calibration data without CRC - arm64: irq: exclude the softirq stack switch from KCOV - ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() - cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() - cipso: adjust cached option offsets when removing CIPSO - dm ioctl: don't let data_start run past the buffer - usb: f81604: fix struct f81604_int_data size mismatch - wifi: brcmfmac: fix P2P device removal race in brcmf_detach() - wifi: mt76: mt7603: initialize global station WCID - wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init() - wireguard: queueing: preserve tstamp_type when encapsulating packet - wireguard: noise: reject response consumption after intermediate initiation - workqueue: Fix NULL current_pwq deref in chained work check - xen/netfront: don't leak the skb when xennet_fill_frags() fails - tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() - strparser: make sure __strp_recv isn't running before tearing down the parser - swiotlb: fix default_swiotlb_limit() for non-growable default pool - tcp: reject net_iov in zerocopy receive mapping hints - tipc: destroy topsrv workqueues before closing connections - tipc: hold a reference to nodes found by link name - Revert "wifi: libertas: reject short monitor TX frames" - selinux: fix data race on AVC latest_notif - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute - EDAC/amd64: Mask UMC chip select to the four implemented selects - gpio: mpsse: fix race when arming the IRQ poll worker - gpio: xilinx: fix runtime PM leak on request error path - gve: fix napi_disable deadlock when attempting to disable XSK pools - gve: fix XSK buffer leak when rings are stopped - gve: fix XSK buffer leak on error descriptor - ibmveth: h_free logical LAN on open-fail after register - ibmveth: fix TX LTB and filter unwind on open-fail - ice: fix use-after-free in dynamic port cleanup - ice: fix metadata_dst refcount handling on representor teardown - keys: finalize persistent keyring timeout after link attempt - KEYS: Fix add_key() race with keyring restriction - memstick: core: wait for request completion before freeing card - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them - mm: don't schedule deferred kernel page table freeing while booting - dm-crypt: reject the lmk IV mode with AEAD ciphers - dm-integrity: fix buffer overflow in inline mode with large tag size - dm-snap: reject the transient exception store for snapshot-merge - dm: fix reading free memory in do_resume - mmc: cavium-octeon: destroy slot platform devices on remove - mmc: cavium-thunderx: destroy slot platform devices on remove - mmc: mtk-sd: Cancel request timeout work on remove - mmc: sdhci-sprd: disable runtime PM on remove - net/packet: guard the ll header push in packet_rcv_spkt() - net/smc: protect clcsock lifetime in smc_getname - net: bridge: avoid recursive multicast port cleanup - net: dsa: microchip: fix KSZ8765 fiber detection - net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() - net: sparx5: free the matchall entry on destroy - net: usb: ax88179_178a: fix rx frame length for non-last packets - net: team: stop reusing skb after queue override - net: team: free skb when broadcast has no txable port - nvme: fix swapped ZRASF zone state values for full and read only - openvswitch: fix soft lockup in the netlink flow dump - optee: register TEE devices only once fully initialized - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers - regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 - pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains - pmdomain: rockchip: don't ignore clock lookup errors on attach - pmdomain: rockchip: fix clock leak on domain probe failure - pmdomain: rockchip: propagate subdomain add errors - scsi: qedi: Initialize callback state before registration - riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp - riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE - riscv: fix load_unaligned_zeropad() fixup for RV32 - riscv: futex: untag the user pointer before the atomic access - riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header - Bluetooth: btintel_pcie: use managed IRQ teardown - Bluetooth: hci_sock: Serialize dead-device detachment - Bluetooth: hci_sync: Fix command skb lifetime during scan setup - Bluetooth: ISO: Reject concurrent BIS listener setup - Bluetooth: ISO: Serialize concurrent connect calls - Bluetooth: MGMT: Fix status of pending commands flushed on power off - Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() - Bluetooth: RFCOMM: free the skb when the DLC has no owner - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN - drm/gud: don't keep a connector without a CRTC as connector_state - drm/i915/gem: Prevent overstepping exec array boundary - drm/i915/gt: Unmask interrupts only when ACTIVE is true - drm/imagination: Size page table preallocation by device address - drm/vc4: drain the hangcheck timer and works on V3D unbind - drm/vc4: Fix firmware reference leak in vc4_drm_bind() - drm/vmwgfx: validate pitch coming from userspace - drm/xe: Fix shrinker accounting double-subtraction on nested external pins - drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin - drm/amdkfd: align SDMA doorbell base for shader doorbell writes - drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info - drm/amdgpu: serialize vblank counter reads against GPU reset - drm/amdgpu: make Mac FB workaround generic - drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks - drm/amdgpu/userq: only accept doorbell BOs as queue doorbell - drm/amdgpu/userq: return the memdup_user() error for the user MQD - drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs - mount: keep a copied mount unbindable - fs: don't silently unmount busy mounts - namespace: reset the old parent's ->overmount in mnt_change_mountpoint() - namespace: don't inherit MNT_UMOUNT in clone_mnt() - namespace: don't copy an unmounted mount tree - fs: refuse fspick() on internal superblocks - namespace: check the target before walking it in do_mount_setattr() - namespace: queue a mount only once for mount notifications - namespace: check a submount for references right before unmounting it - namespace: check a recursive bind mount for mount namespace loops - namespace: look at the topmost mount for a mount namespace file - namespace: remove the fsnotify marks of a mount namespace in process context - namespace: check the mounts before reading their parents in pivot_root() - dcache: don't put a mountpoint on a dentry that's being removed - namespace: don't let a pseudo dentry become the root of a mount - namespace: unhash a dentry before detaching the mounts on it - namei: don't reveal overmounted entries in refwalk - fcntl: refuse F_SET_RW_HINT on an immutable inode - namespace: refuse an automount below a mount that is in no namespace - namespace: never expire a locked mount - namespace: handle mount locking for automounts correctly - ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands - accel/amdxdna: Fix NULL pointer dereference of mgmt_chann - accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding - s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code - drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length - NTB: core: Add .get_dma_dev() callback to ntb_dev_ops - NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers - svcrdma: Add Write chunk WRs to the RPC's Send WR chain - svcrdma: wake sq waiters when the transport closes - blk-cgroup: delay freeing policy data after rcu grace period - ring-buffer: Skip invalid sub-buffers when validating persistent ring buffer - ipv6: mcast: annotate data-races around mca_users - arm64: dts: lx2160a: fix incorrect pinmux - arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single - arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value - mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount - fs: don't let a migrating task hide its reference from do_umount() - Bluetooth: btintel_pcie: fix TX descriptor bounds check - Bluetooth: btintel_pcie: Add shared HW reset for clean start - drm/dp: don't mark the AUX backlight enabled when enabling failed - gpio: exar: initialize the ID before registering its cleanup - drm/aspeed: Balance the display clock enable on teardown - drm/vc4: Free the BO cache size list on teardown - net/sched: em_text: reject unterminated algo before autoload - amt: send the relay's General Query directly from the receive path - cxgb4/ch_ktls: disable softirqs around tid_list erases - tee: optee: fix kernel-doc warnings - tee: optee: ffa: support shared memory offsets on large-page kernels - ice: Restore Ordered MMIO Writes for Tx Doorbells - nvmet: return Invalid Field for invalid NSIDs feature 82h - nvmet: use the local P2P device on metadata allocation failure - arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3 - zloop: zero out only the unread tail of short reads - btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio - btrfs: free iov when btrfs_uring_read_extent() fails - btrfs: unlock inode and extent in caller when io_uring read extent fails - btrfs: fix xattr replace when multiple xattrs are packed in the same item - btrfs: fix lost error return value in btrfs_listxattr() - drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums - net: make dev_xdp_sb_prog_count() see programs attached through a link - riscv: vector: Fix data pointer constraints in context save/restore - riscv: vector: Fix output operands in context save - wifi: mt76: don't return TXQ when exceeding max non-AQL packets - wifi: mac80211: add AQL support for multicast packets - wifi: mac80211: add ieee80211_txq_aql_pending() - wifi: mt76: add PS buffering support for HW-managed TIM drivers - wifi: mt76: account non-AQL frames per peer rather than per link - wifi: mt76: route nullfunc frames to PSD/ALTX queue - wifi: mt76: use ALTX queue for packets to disassociated stations - wifi: mt76: mt7925: restore the legacy BSS after MLO teardown - wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout - wifi: mt76: mt7915: disable rx napi when removing device - wifi: mt76: mt7925: don't put the band auto marker in TGID - wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit - wifi: mt76: mt792x: pick the SAR table layout from the table itself - Revert "wifi: ath12k: add panic handler" - ASoC: adau1372: allow sleepy powerdown GPIOs - ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM - spi: sg2044-nor: Return transfer errors - spi: sg2044-nor: Honor SPI clock limits - cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug() - flow_dissector: avoid u16 truncation of skb->len when computing thoff - net: sparx5: start the TOD counters on non-PTP lan969x variants - devlink: fix devlink_rel reference leak when notify work is pending - net/sched: cls_route: reject change with no routing attribute - Revert "net/mlx5: E-Switch, preserve max tx speed on vport state modification" - net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET - pfcp: make sure the SEID is linear before reading it - bnxt_en: Add bnxt_clear_bars() helper - bnxt_en: Fix driver init in kdump kernel - bnxt_en: Delay for 5 seconds after AER DPC for all chips - bnxt_en: Drop pci_save_state() after pci_restore_state() - bnxt_en: Re-write the BARs following any type of PCIe errors - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() - drm/imagination: Fix reference and vm_bo handling in remap() - veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down - net/mlx5e: Order ICOSQ cc update after CQ doorbell - mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() - ptp: ocp: fix PCIe delay estimation calculation - net: openvswitch: validate transport header presence in set_ipv6_addr - vsock: Fix memory leak in vmci_transport_recv_dgram_cb() - drm/vc4: Fix binner slot allocation failing on an idle GPU - x86/CPU/AMD: Fix AMD TLBI Erratum #1718 - drm/panthor: validate userspace queue count against initialized firmware slot count - s390/zcrypt: Improve CCA CPRB length and overflow checks - s390/zcrypt: Improve EP11 CPRB length and overflow checks - s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing - s390/zcrypt: Pad trailing CCA or EP11 message with zeros - xfs: remove duplicate INO1_WRITTEN check - xfs: stop exchanging reflink flags when exchanging mappings - xfs: fix exchange-range-to-eof file size exchange - can: fix unique skb identifier regression under RPS - SUNRPC: Add Kconfig dependency on CRYPTO_KRB5 - regulator: of: fill in supply names in of_regulator_bulk_get_all() - drm/amd/display: Don't replace a sink mode that shares the native totals - sched_ext: Generate qseq from a per-task counter - HID: steam: Fully unregister controller when hidraw is opened - HID: steam: Rearrange teardown sequence - HID: steam: Refactor registration - HID: steam: Clean up locking - ipv4: udp: Create exceptions before socket matching - ipv6: udp: Create exceptions before socket matching - can: dev: init_can_skb(): restore skb header initialization - e1000e: add system to disable K1 list - fsverity: RCU-delay the freeing of struct fsverity_info - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test - iavf: send MAC change request synchronously - io_uring/register: don't exempt disabled rings from task restrictions - ip6_tunnel: do not use dst6_mtu() in ip4ip6_err() and ip6erspan_tunnel_xmit() - ip6_gre: remove obsolete ERSPAN PMTU update - mm/vma: introduce vma_test[_any[_mask]](), and make inlining consistent - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop - power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all() - scsi: ch: Do not keep references to data transfer element devices - scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() - scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ - riscv: patch: fix handling of bpf-jit execmem addresses - riscv: ptrace: reject CFI regset access when extensions are absent - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex - drm/xe/i2c: cancel the client work on remove - drm/amd/display: disable self-refresh on tearing flips - statmount: read the parent of an unmounted mount under mount_lock - namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE - namespace: don't reconfigure internal superblocks via remount and umount - unshare: don't drop active namespace references that were never taken - nullfs: don't update the access time - clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks - clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable - iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys - scsi: ufs: core: Hold a clock reference across the probe - drm/bridge: Fix unlocked list_del in drm_bridge_add() - drm/bridge: Fix unlocked list access in drm_bridge_attach() - cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() - drm/vc4: Use kvmalloc_objs() for the BO cache size list - lib/dim: fix 32-bit overflow in dim_calc_stats() rates - net: stmmac: propagate PTP addend and system time programming errors - bonding: fix the program leak when XDP is replaced - btrfs: don't stash io_uring encoded data across -EAGAIN - drm/xe: Do not emit Wa_16010904313 twice - net/mlx5: Lag, split aggregate speed into oper and max helpers - net: stmmac: Do not advertise S-VLAN stripping when it is disabled - net: stmmac: Disable S-Tag processing on dwmac4 - net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param() - Revert "net: stmmac: propagate PTP addend and system time programming errors" - scsi: ufs: mediatek: Handle mPHY power-on failures - net: always dissect GSO packets in __virtio_net_hdr_to_skb() - ASoC: sdw_utils: Add codec info for CS35L62 - ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI - riscv: ptrace: Zero-initialize regset buffers before copyin - bareudp: set the inner protocol to the protocol of the packet - net/packet: call packet_parse_headers after virtio_net_hdr_to_skb - drm/vc4: Use devm_request_irq() for automatic cleanup - drm/vc4: Disable the V3D interrupt across runtime suspend - io_uring/memmap: account the pages a compound region really uses - io_uring/zcrx: use better name for RQ region - io_uring: cast id to u64 before shifting in io_allocate_rbuf_ring() - io_uring/zcrx: use correct mmap off constants - io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK - io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge - Upstream stable to v6.18.57, v7.2.11 * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-98038 - bpf: Keep refcount_acquire nullable for borrowed RCU kptrs * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-93175 - drm/amd/display: Fix dangling pointer in CRTC reset function * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-90317 - bpf: Invalidate RCU pointers after final spin unlock * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-90315 - PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-90167 - ksmbd: serialize oplock close with pending break ownership * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-90162 - ksmbd: defer publishing granted locks to prevent UAF/double-free race * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-90155 - ksmbd: detach blocked lock requests before freeing * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-90144 - dpll: fix NULL deref in dpll_device_ops() during teardown race * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-89907 - LoongArch: KVM: Validate MSI data before routing it to EIOINTC * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-89709 - lockd, nfsd: RCU-protect nlmsvc_ops dispatch * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-89568 - kho: fix size calculation in kho_preserved_memory_reserve() * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-74568 - KVM: arm64: vgic: Fix race between LPI release and re-registration * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-74527 - octeontx2-af: Block VFs from clobbering special CGX PKIND state * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-74466 - s390/zcrypt: Close speculative mem read possibility * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-72497 - RDMA/bnxt_re: Add a max slot check for SQ * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-72404 - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2026-68305 - drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers * Resolute update: upstream stable patchset 2026-10-21 (LP: #2171601) // CVE-2024-50169. - vsock/virtio: account only unread bytes in read_skb() * Resolute update: upstream stable patchset 2026-10-20 (LP: #2171596) - selftests/mm: hugetlb-mremap: add setup of HugeTLB pages - mm/execmem: make the populate and alloc atomic - ASoC: sdw_utils: Set snd_soc_dai_link_ch_map.codec_ch_mask for capture - Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table - smb/client: pass cifs_open_info_data to SMB2_open() - ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices - audit: fix exe mark UAF in kill_rules() - crypto: x86/aes-gcm - fix always true check for last AAD segment - HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request - HID: multitouch: stop the release timer from being rearmed on remove - io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full - io_uring/zcrx: requeue multishot receives stopped by a local resource - kasan: unpoison task stack below watermark only in generic mode - kprobes: Skip disarmed probes when checking optkprobe overlap - octeontx2-pf: Fix RSS indirection table size - of/irq: Fix remaining refcount leaks in of_irq_init() - of/overlay: put property on deadprops only after changeset add succeeds - of/overlay: only treat a positive changeset id as registered - net: fix checksum offsets in skb_splice_from_iter() - net: phy: aquantia: fix system interface type not updated in forced mode - netfilter: nft_flow_offload: drop flowtable reference on init error path - net/packet: prevent TX_RING byte count overflow - r8169: disable EEE on RTL8168h/8111h - rtc: ac100: Assign .num before accessing .hws - rtc: spear: initialize IRQ state before requesting alarm IRQ - sctp: check RCV_SHUTDOWN after the sendmsg connect wait - tpm: Disable TPM on null key name mismatch - netfs: zero gaps in read-gaps folio to avoid writing back stale data - module: fix lost error code from codetag_load_module() - virt: vmgenid: remap memory as decrypted - virt: vmgenid: set driver_data before registering notification handlers - mm: shmem: ignore sysfs configs for shmem forced collapse - rds_tcp: close NULL deref window in rds_tcp_set_callbacks - vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF - vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() - vt: skip screen update for DEC alignment test on backgroup consoles - wifi: wlcore: Fix runtime PM leak in wlcore_remove() - ALSA: caiaq: unregister the input device when probe fails - ALSA: line6: reject oversized playback packets - random: vDSO: avoid call to memset() when zeroing reserved parameter - [Config] Add CC_OPT_INLINE_MEMSET compiler option - mm/damon/core: don't skip damos_adjust_quota() while esz is not zero - iio: dac: rohm-bd79703: Do not allow writing SCALE - iio: light: rohm-bu27034: Fix error return - iio: accel: kionix-kx022a: Fix array boundary check - mtd: core: call _get_device() with the master MTD - nvmet: preserve device path on allocation failure - random: fix vgetrandom_opaque_params kernel-doc - of/overlay: don't leak fragment references when changeset init fails - of/overlay: don't create "//" paths for fragments targeting the root - ASoC: wm8903: Move the DRC QR threshold to the register that holds it - wifi: wfx: validate MIB read length before copying to caller - ASoC: tegra: Fix ASRC Stream6 input threshold control - wifi: mac80211: drop oversized fragments to avoid extra_len overflow - wifi: ath11k: reset ar->num_stations on hardware start - wifi: ath9k: reject short WMI command responses - wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE - rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak - rtc: ac100: Fix clock provider use-after-free on probe failure - rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() - wifi: cfg80211: preserve hidden-group beacon IE ownership - wifi: mac80211: Add multicast to unicast support for 802.3 path - wifi: mac80211: Add 802.3 multicast encapsulation offload support - wifi: mac80211: prevent AP VLAN tx from other interfaces - ASoC: codecs: rt286: Revert delay value for jack setup - ASoC: codecs: rt274: Fix format setting for 44100 rate - block: reject polled dio with user integrity metadata - blk-mq: set RQF_USE_SCHED when the operation is known - Bluetooth: hci_core: free the HCI ID if naming fails - Bluetooth: btintel: validate DDC record lengths - arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz - ARC: arch_cmpxchg_relaxed to use size of pointed type not pointer - net/mctp: publish the mctp_dev only after it is initialised - net/sched: cls_api: reclaim an empty proto on the error path - net: bcmgenet: allocate RX buffers as page fragments - ipv6: fix prefix route expiry in modify_prefix_route() - netfilter: ipset: do not update comments from kernel-side adds - Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister - net: systemport: Fix buffer overflow in bcm_sysport_get_stats() - net: systemport: Fix RUNT MIB counter register offset calculation - net/mlx5: Fix slab-out-of-bounds when handling team device events - octeontx2-af: mcs: Fix SC resource cleanup loop - tipc: prevent GCM nonce reuse on peer key changes - net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() - net: stmmac: fix rx Scatter-Gather support - net: restrict SO_RESERVE_MEM to TCP sockets and cap max value - gve: DQO: accept TSO packets with non-protocol gso_type bits - net/sched: fq_codel: match the no-drop threshold to the packet size - net/sched: sch_codel: match the no-drop threshold to the packet size - virtio_blk: set the zone write granularity - net: pcs: rzn1-miic: Clear MIIC protection state before unprotect sequence - net: bcmgenet: fix NULL dereference in set_coalesce before first open - net: cap skb->queue_mapping when the tx queue is picked - net: ethernet: mtk_eth_soc: allocate dummy netdev sooner - net: phy: qcom: at803x: Fix IPQ5018 short-cable DAC values - net: sparx5: move netdev and notifier block registration to probe - net: sparx5: move VCAP initialization to probe - net: sparx5: move MAC table initialization and add deinit function - net: sparx5: move stats initialization and add deinit function - net: sparx5: move PTP IRQ handling out of sparx5_start() - net: sparx5: skip ptp deinit if init was skipped - tcp: refresh TS.Recent for accepted old ACKs - ipvs: fix missing counter decrement in lblc - ipvs: do not create invisible templates - ipvs: filter some flags received in the backup server - netfilter: bpf: reject invalid NAT manipulation types - netfilter: flowtable: generalize pending status bit - net: microchip: vcap: stop scanning after deleting key field - of: Put coreboot node after compatibility check - net: sparx5: make ports inherit the switch base mac address type - net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference - ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() - net: mvneta: clear XDP pfmemalloc flag between frames - i2c: at91: release DMA channels when probe defers - perf: Fix race between perf_event_exit_task() and perf_pending_task() - ALSA: core: Define auto-cleanup for snd_card_free() - ALSA: ice1712: Fix the error handling via auto-cleanup at probe - spi: cs42l43: Workaround for wrong speaker ID on Dell XPS 13 DX13260 - PCI: Accept AtomicOps already enabled by the hypervisor - drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend - drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC - drm/amd/pm/si: Fix updating clock limits on AC/DC - drm/amdgpu/gfx6: fix firmware leak on teardown - drm/radeon: Read the VRAM VBIOS signature with readb() - drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device - drm/mediatek: Fix ovl adaptor platform device leak - drm/mediatek: Fix pdev reference leak in mtk_drm_bind() - drm/amdgpu: fix IP instance memory leak on kobject add failure - drm/amdgpu: fix ACP MFD device leak on init failure - drm/amdgpu: skip the noirq suspend reset for a switcheroo-parked GPU - binder: fix is_failure flag for superseded transaction cleanup - binder: fix leaked fd fixups on TF_UPDATE_TXN supersede - kgdboc: Fix tty driver reference leak in configure_kgdboc() - Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 - Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 - Input: s6sy761 - fix resume ordering and restore sensing - Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 - Input: synaptics - limit T440p InterTouch quirk to LEN0036 - nitro_enclaves: fix use-after-free on SLOT_ALLOC failure - rust_binder: cancel deferred work items in thread exit - soc: qcom: geni-se: Correct QUP Core ICC vote constants - USB: cdc-acm: fix racy TIOCMIWAIT implementation - USB: cdc-acm: skip URB restart in port_shutdown if disconnected - USB: serial: fix port tear down use-after-free - usb: storage: sierra_ms: reject short SWoC info transfers - usb: hub: use shorter 120ms post resume hold for SS root hubs - usb: octeon-hcd: fix the FIFO-flush timeout computation - usb: ohci-da8xx: disable controller wakeup on cleanup - usb: ohci-s3c2410: disable controller wakeup on removal - usb: ohci-spear: disable controller wakeup on removal - usb: ohci-st: disable controller wakeup on removal - usb: gadget: midi2: Fix the jack descriptor array sizes - usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd - usb: typec: anx7411 - stop the IRQ before destroying the workqueue - usb: typec: port-mapper: Only match USB4 port if host interface is available - usb: dwc3: am62: Fix runtime PM usage count leak on probe error path - usb: gadget: aspeed-vhub: cancel wake work on device removal - USB: gadget: dummy-hcd: Fix wait for outstanding request completions - usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC - usb: chipidea: tegra: disable runtime PM on resume failure - usb: core: clear both ep_in and ep_out for non-ep0 control endpoints - USB: dwc2: shut down wakeup timer before freeing HCD state - usb: typec: tcpm: recover after failure to start the frs ams - usb: typec: tipd: don't send GAID when probe fails in APP mode - usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() - usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work() - usb: typec: ucsi: glink: fix use-after-free of ucsi on remove - usb: typec: ucsi: Get the connector fwnode based on reg value - usb: typec: ucsi: displayport: Current CAM OOB index fixup - usb: cdns3: fix use-after-free in cdns3_gadget_exit() - usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe - tty: vt: fix memory leak in vc_allocate() - tty: amiserial: fix broken TIOCMIWAIT - tty: vcc: zero-initialize control packet in vcc_send_ctl() - tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup - tty: tty_port: restore TTY_IO_ERROR on activation failure - tty: port: fix tty_port_tty_vhangup() race - tty: serial: qcom_geni_serial: Keep console RX functional after deep idle - tty: abort break signalling on hangup - tty: serial: max3100: shut down timer before freeing port - serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() - serial: 8250_omap: fix wake irq cleared during suspend - serial: revert guards in uart_wait_modem_status() - serial: fix TIOCMIWAIT race - serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() - serial: tegra: don't clear the Tx FIFO on an Rx-only reset - serial: vt8500: Fix clock reference leak in vt8500_serial_probe() - serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap- around - serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL - arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems - ASoC: codecs: max98363: fix uninitialized stream_config->type - ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type - ASoC: qcom: lpass-cpu: use DAI table index for playback constraints - ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 - ALSA: seq: Serialize compat port-info ioctls - ALSA: ua101: reject mismatched capture/playback packet sizes - ALSA: hda/realtek: Fix square wave output on ASUS Strix G615LR - ALSA: hda/realtek: Fix silent speaker on Higole F9B - EDAC/versalnet: Drop remote processor handle refcount on driver removal - EDAC/altera: Do not allow driver unbinding - EDAC/altera: Drop __init from ECC setup paths for re-probe safety - EDAC/altera: Fix memory leak on dci allocation failure - EDAC/altera: Fix use-after-free in error paths - EDAC/altera: Fix device node reference leaks in the SDMMC ECC setup - i2c: xiic: preserve PEC byte length in SMBus block read setup - i2c: xiic: don't clobber msg->len to signal block-read completion - Bluetooth: RFCOMM: Fix initial port reference race - Bluetooth: hci_sync: Fix inquiry cache use-after-free - Bluetooth: hci_conn: Lock parent access during enhanced SCO setup - Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems - Bluetooth: hci_core: Serialize ACL scheduling with channel deletion - Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown - Bluetooth: hci_core: Serialize fragmented ISO packet queueing - Bluetooth: btintel: fix buffer over-read in btintel_hw_error() - Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() - x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h - x86/mm: Drop unnecessary PMD page copy when freeing - mm/damon/core: do non-safe region walk on kdamond_apply_schemes() - fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching() - io_uring: fix task_work add use-after-free with SQPOLL - ipvs: bound LBLCR and LBLC cache growth - net: extend IPv6 exthdr detection of tunneled packets - tpm: fix off-by-four bounds check in tpm2_get_random() - nvme-multipath: fix underflow in ANA log bounds checks - nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT - nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() - nvmet: pci-epf: reject too-short SGL segments - mtd: block2mtd: Fix divide error when erase_size is zero - mtd: mtd_intel_dg: reset poll counter for each erase - mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ - mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB - mtd: spi-nor: core: Fix mutex leak in spi_nor_rww_start_exclusive() - mtd: spinand: Enable QE on all dies - mtd: spinand: fix zero oobavail when no ECC engine is used - mtd: spinand: Do not update the QE bit on devices without one - KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified - KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it - KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state - KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy - KVM: arm64: Clear HCR_EL2.RW for 32-bit non-protected vCPUs - KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor - wifi: cfg80211: fix RTS threshold setting for single-radio PHY - wifi: cw1200: fix TX padding OOB read leaking heap data to device - wifi: iwlegacy: 3945: free EEPROM data on remove - wifi: mac80211: keep paired old chanctx alive - wifi: mac80211: shut down RX BA session timer on teardown - wifi: mac80211: drain PS delivery work during station teardown - wifi: mac80211: account proxy paths against the mesh path limit - wifi: mac80211: keep fallback association elements alive - wifi: mac80211: minstrel_ht: validate fixed rate index - wifi: mac80211: reject invalid 320 MHz CSA bandwidth - wifi: mac80211: release mesh path quota on failed additions - wifi: mac80211: fix mesh fast xmit path deletion UAF - wifi: mac80211: handle empty FILS association request payload - USB: serial: cp210x: add Corsair AX1500i Power Supply - USB: serial: quatech2: fix baud rate overflow - USB: serial: ssu100: fix baud rate overflow - USB: serial: fix dynamic id driver deregistration race - USB: serial: fix driver deregistration order - USB: serial: fix ioctl hangup race - USB: serial: option: add support for SIMCom SIM8260C - USB: serial: option: add Quectel EG060W - USB: serial: option: add Compal EXM-G1x support - USB: serial: option: add Quectel RG660QB - USB: serial: option: add Compal EXC-T1 support - thunderbolt: Fix KASAN reported use-after-free when request is canceled - thunderbolt: Hold a router reference for each allocated HopID - thunderbolt: Mark discovered tunnels as active - thunderbolt: Tear down inactive DP tunnels when the domain is stopped - thunderbolt: Fix domain reference leak when DPRX read is canceled - thunderbolt: Disable CL states for the Anker Prime TB5 dock - thunderbolt: Reject oversized XDomain properties responses - smb: client: discard post-EOF pagecache when extending a file via zero range - smb: client: discard post-EOF pagecache when extending a file via copy range - smb: client: flush and commit data before querying allocated ranges - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races - iio: accel: kionix-kx022a: Prevent memory leak and fix state - iio: accel: kxcjk-1013: reject duplicate event disable - iio: accel: sca3000: fix frequency divider condition check - iio: adc: ad7173: Fix digital filter configuration - iio: adc: ad_sigma_delta: fix use-after-free on unbind - iio: adc: ade9000: fix NULL pointer dereference in clkout registration - iio: adc: ade9000: fix overlapping scan_index for current and voltage channels - iio: adc: ade9000: handle Phase C dip events in IRQ1 handler - iio: adc: ade9000: request interrupts after powering the device - iio: adc: axp288: Add TS bias override for Haier HV103H - iio: adc: max1363: sign-extend bipolar differential channel reads - iio: adc: pac1934: check ACPI label duplication - iio: adc: rohm-bd79124: Catch regmap errors at measurement start/stop - iio: adc: rohm-bd79124: Fix channel initialization - iio: adc: rohm-bd79124: Fix GPIO mask check - iio: adc: rohm-bd79124: Fix rising alarm - iio: adc: stm32-adc: fix check on internal channel availability - iio: adc: stm32-adc: fix possible division by zero in processed channel - iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure - iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls - iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind - iio: admv1013: initialize callback mutex before registering notifier - iio: buffer: serialize buffer teardown with mode claims - iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. - iio: cdc: ad7150: fix OF matching and publish module aliases - iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() - iio: gyro: adis16136: fix unprotected debugfs reads - iio: health: max30102: fix NULL dereference in interrupt handler - iio: imu: adis16400: fix unprotected debugfs reads - iio: imu: adis16480: fix unprotected debugfs reads - iio: light: gp2ap020a00f: drain irq_work after free_irq - iio: light: rohm-bu27034: Fix infinite delay on error - iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup - iio: pressure: rohm-bm1390: Return error when read fails - iio: proximity: aw96103: validate firmware data length - iio: proximity: isl29501: Fix return type of isl29501_register_write - iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure - iio: proximity: sx9324: Correct proximity channel resolution - iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler - iio: proximity: vl53l0x-i2c: claim direct mode for raw reads - iio: trigger: cancel reenable_work before freeing trigger - mptcp: fix msk->timer_ival reset - mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages - pfcp: fix socket lifetime on netdevice registration failure - netfs: clear post-EOF pagecache when extending a file via write - mm/vma: predicate setting mmap_prepare VMA fields on new vma alloc - rust: devres: ensure revocation is complete before device finishes unbinding - rust: irq: pass RegistrationInner as cookie to request_irq - Bluetooth: Serialize SMP remote OOB data access - nvmet-tcp: Don't error if TLS is enabed on a reset - nvmet: copy the hostid into the ctrl before creating PR pc_refs - nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known - mtd: spinand: fix NULL pointer dereference with no ECC engine - wifi: mac80211: count only matching reservations in reserved switch - wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit() - wifi: mac80211: set info->band for 802.3 encap offload frames - thunderbolt: Don't access a DP tunnel after its DPRX read was canceled - smb: client: flush dirty data before zeroing a range - smb: client: distinguish real EOF from a stale remote_i_size on read - iio: adc: aspeed: propagate reset deassert errors - smb: client: only require read lease for size-extending preallocate - iio: adc: ad4030: fix invalid oversampling_ratio validation - drm/amd/display: Mark DCE 6.4 as not APU - drm/amd/display: Preserve eDP mode on initial ASSR failure - drm/amdgpu: reset VI ASIC on MacBookPro15,1 - drm/amdgpu: reset VI ASIC on MacBookPro14,3 - drm/amd/display: Fix fast updates on DCE 8.1 - usb: dwc3: gadget: fix IRQ storm on invalid event buffer count - tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2 - usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41 - tty: fix saved termios reset race - perf: Replace perf_event_header__init_id with full header init - perf/core: Check kernel access when kernel callchains are requested - perf: Require kernel access for text poke events - arm64: mm: Fix the break-before-make flush range for erratum 2645198 - arm64: errata: Factor out broken AMU const counter cap - [Config] Enable ARM64_WORKAROUND_BROKEN_AMU_CONSTCNT - arm64: errata: Add Cortex-A725 erratum 3821522 workaround - [Config] Enable ARM64_ERRATUM_3821522 - KVM: x86: Move IRQ-related helper declarations from kvm_host.h => irq.h - KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT - KVM: arm64: Use stage-1 leaf size for VM_PFNMAP - KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted - KVM: move TSS constants from kvm_host.h to tss.h - KVM: x86: Add static calls for nested virtualization ops - KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails - net: usb: qmi_wwan: add Quectel EG120K-EA - xen/netfront: drop RX packets with a short Ethernet header - net: mana: remove double CQ cleanup in mana_create_rxq error path - iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs - iio: adc: adi-axi-adc: Initialize state mutex - ipv4: free inet_opt and ireq_opt after an RCU grace period - drm/xe/i2c: Keep the i2c controller always enabled - selftests/cgroup: account for zswap shrinker writeback - KVM: x86: Move nested_run_pending to kvm_vcpu_arch - KVM: x86: Fill kvm_run exit fields in common get_nested_state_pages() error paths - net: gso: limit recursive IP-in-IP segmentation - sysctl: Negate before converting in the int read path - time/jiffies: Saturate in mult_hz() instead of wrapping - netfs: zero the tail of a short DIO/unbuffered read - ALSA: ctxfi: Fix silent playback on Titanium HD (SB1270) - ext4: don't enable large folios on encrypted inodes - mtd: core: avoid double-free of OTP NVMEM device - wifi: ath9k: Clean up device initialisation guards - wifi: mac80211: validate TX status rate metadata - mm/slab: handle the !allow_spin case in kfree_rcu_sheaf() - mm/slab: do not wake up kswapd in __kfree_rcu_sheaf() - ASoC: SDCA: Set suspended flag after resuming within system suspend - ASoC: SDCA: Add better pm_runtime error handling in func probe - bpf: Fix overflow of jump offset in constant blinding - nvme: fix command effects log lifetime for multipath heads - bpf: Hold map BTF for the memory allocator destructor record - wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() - drm/xe/pf: Refactor VF LMEM BAR resize helper function - drm/xe/pf: Keep VF LMEM BAR size low if no VFs enabled - drm/mediatek: mtk_hdmi_v2: fix VID_DOWNSAMPLE_CONFIG register offset - octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled - seg6: ensure packet data is writable before modifying SRH and IPv6 DA - net: ethtool: let tsconfig reach a PHY-only timestamp provider - bpf: Wait for an RCU tasks grace period before freeing trampoline progs - bpf: Skip detached progs in trampoline images that are still in use - bpf: Factor out __do_call_rcu_ttrace() - bpf: Fix objects stuck in free_by_rcu_ttrace - drm/mediatek: Fix runtime PM leak in mtk_hdmi_ddc_v2_probe() - futex: Fix private hash use-after-free on resize - drm/amd/display: guard dc_sink dereferences in MST mode validation - drm/amd/display: Fix fast updates on DCE 6.x - drm/amdgpu/gmc12.1: properly pass flush_type to gmc_v12_1_flush_vm_hub() - drm/amdgpu/gmc12: properly pass flush_type to gmc_v12_0_flush_vm_hub() - drm/i915/vrr: Disable DC balance by default - drm/amdgpu: drop userq callback assignment for sdma 7.1 - binderfs: fix UAF write in binder_add_device - clk: spacemit: k3: add CPU PLL rate tables - serial: core: fix NULL pointer dereference in serial_core_unregister_port() - ASoC: codecs: lpass-wsa-macro: rewrite the interpolator volume after enabling clocks - ALSA: hda/realtek: Add quirk for Acer Nitro ANV15-41 - ALSA: hda/realtek: Update Acer Nitro ANV15-41 quirk to enable mute LED - ALSA: hda/realtek: Add micmute LED quirk for Acer Swift SFG16-72 - Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() - KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN - KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded - KVM: arm64: vgic: Allow last_lr_irq to be NULL when LRs are not overflowing - KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq - thunderbolt: Make the DP tunnel activation callback mandatory - smb: client: discard post-EOF pagecache when extending a file via clone range - smb: client: only require read lease for size-extending zero range - smb: client: drain and invalidate before server-side copy/clone - smb: client: require stable pages for signed connections - iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data - Upstream stable to v6.18.56, v7.2.10 * Resolute update: upstream stable patchset 2026-10-20 (LP: #2171596) // CVE-2026-89764 - rust: devres: fix race between concurrent revokers linux (7.0.0-42.42) resolute; urgency=medium * resolute/linux: 7.0.0-42.42 -proposed tracker (LP: #2170920) * Miscellaneous Ubuntu changes - SAUCE: Revert "powerpc: Don't drop _TIF_RESTOREALL on syscall restart" linux (7.0.0-41.41) resolute; urgency=medium * resolute/linux: 7.0.0-41.41 -proposed tracker (LP: #2170001) * Fix SDCA jack detection race and reprobe issues on Dell Slate Max platform with CirrusLogic audio solution (LP: #2163215) - ASoC: Add a component fixup_controls callback - SAUCE: ASoC: SDCA: Bind jack interrupts to their control after card probe - SAUCE: ASoC: SDCA: Do not leak or reuse jack state across a card rebind * [SRU] Fix for storage corruption on 64 bit DMA on AMD platforms (LP: #2166838) - ata: Use named initializers for pci_device_id arrays - Revert "ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585" * Fix missing headset on Dell QCx1255 models (LP: #2169175) - ALSA: hda/realtek - Add headset mode for Dell Pro QC1255 * RTC device disappears after updating to 7.0.0-39-generic (LP: #2169736) - ACPI: x86/rtc-cmos: Use platform device for driver binding - ACPI: PNP: Drop CMOS RTC PNP device support - rtc: cmos: Use platform_get_irq_optional() in cmos_platform_probe() * Resolute update: upstream stable patchset 2026-10-07 (LP: #2169900) - drm/amd/display: Atomize IRQ register read/modify/write ops - ALSA: hda/realtek: Limit Star Labs internal mic boost - ALSA: hda/realtek: Add StarFighter HDA SSID - remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage - KVM: s390: Fix IRQ injection with SIGP Stop and Store Status - s390/uv: Fix loop condition in uv_find_secrets - s390/uv: Prevent potential out-of-bounds read - bpf: Fix bpf_skb_change_tail wrt csum partial skbs - bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL - selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc - bpf: Fix divide-by-zero in btf_struct_walk() - bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() - tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context - HID: multitouch: Add report ID mismatch quirk for ASUS ROG Z13 Folio - HID: elecom: fix bus type for M-XGL20DLBK - KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() - bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() - bpf: Fix out-of-bounds read of rtt_min in sock_ops - bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk - bpf, sockmap: Fix self-redirect copied_seq double-counting - bpf, arm64: set up the frame pointer for the exception callback - pinctrl: meson: Fix typo in s4 group name - HID: amd_sfh: Validate PCI BAR size before mapping - HID: bpf: fix __hid_bpf_hw_check_params report length - KVM: riscv: Fix NACL hfence entry update order - RISC-V: KVM: Preserve firmware counter value across stop/start - RISC-V: KVM: Report snapshot write failure to the guest - RISC-V: KVM: Fix perf-backed counter accounting across stop and read - KVM: arm64: vgic-its: Free the caches when GITS_BASER changes - KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save - KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() - KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure - KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2 - KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0 - KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP - squashfs: Add dictionary size range check to prevent shift-out-of-bounds - scsi: sd_zbc: Reject disks with too many zones - pinctrl: sunxi: A523: fix voltage withstand encoding - Bluetooth: SMP: reject Security Request over BR/EDR - Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump() - Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel - selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode - scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume() - docs: s390/pci: Improve and update PCI documentation - s390/pci/docs: Fix sriov_numvfs attribute name - s390/cio: Fix cio_update_schib() to not cache invalid schib - s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points - s390/cio: Guard PMCW field accesses with dnv check - fs: avoid repeated scans in evict_inodes() - xsk: Use a 32-bit compare in xsk_map_gen_lookup - bpf: Skip unsettled links in link iterator - eth: fbnic: Fix payload page pool error cleanup - net/sched: cls_u32: fix manual hash table handle IDR aliasing - net: pcs: rzn1-miic: Fix config array initialization - octeontx2-af: use seq_file for rsrc_alloc debugfs - net/mlx5: devcom, Base component size on linked devices - bpf: Restrict CO-RE poisoning to relocatable instructions - libbpf: Reject truncated ldimm64 CO-RE relocations - ipv4: fib: fix data-race and stale genid check around nh->nh_saddr - netfilter: flowtable: publish HW_DEAD after worker is done - netfilter: nfnetlink_queue: hold nfnl mutex in event notifier - netfilter: nft_synproxy: use the family-aware checksum helper - ipvs: revalidate ihl before icmp_send - netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name - arm64: io: Reject non-user protection in ioremap_prot() - ocfs2: make ocfs2_calc_xattr_init() return void - drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update - drm/nouveau/clk: don't clobber reclock status when restoring volt/fan - drm/nouveau/disp: don't reject HDMI config on cards without SCDC - net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure - net: gue: reject invalid REMCSUM offsets - net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure - ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink(). - eth: fbnic: Handle maximum standalone channels - eth: fbnic: reset num_napi when the napi vectors are freed - eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox - eth: fbnic: Handle FW mailbox completions flagged with an error - sctp: avoid livelock while updating retransmit path - bpf: Bound ownership depth through local kptrs and graph roots - net: usb: catc: bound the RX packet length in catc_rx_done() - bpf: Check params size before reading reserved fields - net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget - drm/virtio: fix object leak when drm_gem_handle_create() fails - drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() - drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() - drm/virtio: release the GEM object on virtio_gpu_vram_create() errors - Revert "drm/virtio: Allow importing prime buffers when 3D is enabled" - drm/virtio: sync shmem backing on guest-bound transfers - drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach - ovpn: preserve IPv6 scope id for netlink peer endpoints - ovpn: skip UDP source validation for unspecified addresses - ovpn: track UDP socket route key for peer dst cache - ovpn: validate peer state before caching UDP dst - ovpn: replace bind when learning local endpoint - ovpn: replace bind when clearing stale local source - ovpn: always unhash old VPN addresses before rehashing - ovpn: reject duplicate peer VPN addresses - ovpn: reject multipeer peers without VPN addresses - ovpn: reject invalid peer VPN addresses - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough - Bluetooth: btintel_pcie: validate device-supplied DMA indices - Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() - octeontx2-af: Fix memory scaling limitation in SR-IOV mode - ipv6: Prevent rt6_insert_exception() for dying fib6_info. - dpll: use exact lookup for reference sync pin id - net: usb: sr9700: include receive overhead in the length check - ipv6: Fix dst leak for uncached routes. - udp: relocate a connected socket in the 4-tuple hash table on re-connect - udp: remove a disconnected socket from the 4-tuple hash table - tg3: clean up PHYLIB resources on probe failure - drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable - s390/debug: Do not register views for failed static debug areas - s390/debug: Fix NULL pointer dereference in debug_info_copy() - net: spacemit: clear TX descriptor on fragment mapping failure - net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error - genetlink: report the real command id for dump-only ops in policy dumps - net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure - thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds - bpf: Fix bounds check for skb-backed dynptrs - bpf: Fix bpf_sock context code generation - bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc - net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports - net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports - sctp: hold asoc or transport before mod_timer() in timer handlers - net: stmmac: selftests: Support running selftests on DSA conduits - net: stmmac: selftests: Check the dev->features for S-TAG offload testing - net: stmmac: selftests: Capture all packets for vlan checks - net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K - net: stmmac: selftests: Account for alignment shift on dwmac1000 for Jumbo test - eth: fbnic: Avoid rounding zero ring sizes - net/sched: fix potential stack infoleak in em_text_dump() - bpf: Reject dev-bound-only programs on other devices - nfc: nfcmrvl: validate helper command length before pull - nfc: st21nfca: validate received frame size - nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() - selftests: nci: Correct pthread_create return value check - nfc: llcp: Fix race condition in accept_queue lifecycle - selftests: nci: Fix uninitialized family ID on missing attribute - selftests/nci: Fix out-of-bounds store on thread join - nfc: virtual_ncidev: Add missing ioctl compat handler - nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure - nfc: st21nfca: validate ISO15693 inventory length - nfc: llcp: fix -ENOMEM on connect with zero-length service name - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() - nfc: llcp: fix slab-out-of-bounds reads when logging service names - nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() - net/sched: act_gate: budget the per-entry list in get_fill_size - net: bcmgenet: stop Tx NAPI before disabling the queues - veth: manage XDP program pointers during channel resize - net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() - vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets - bpf: Fix immediate JMP JEQ/JNE on MIPS32 - bpf: Fix BSWAP 32 and 16 on MIPS64 - tg3: use random MAC address when tg3_get_device_address fails - net: stmmac: clear stale buf->page after recycling on skb build failure - net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems - net: bcmgenet: initialize u64 stats seq counter for all queues - net: bcmgenet: do not skip WoL power up on GENET V1 - net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr - net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT - ip_gre: Reject enabling collect metadata through changelink - vxlan: use one headroom snapshot for neighbour replies - net: xps: reject an out of range traffic class - drm/imagination: clamp freelist reconstruction requests - bonding: crypto offload enabled, non-offload slave failover, rekey failed - macsec: initialize SecY before registering the netdevice - net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 - net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq - tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() - net: phylink: record the PHY only once bringup cannot fail - nfp: hold IPsec RX state under the XArray lock - net/smc: fix UAF on lgr list traversal in smcr_port_err() - tipc: Fix a data race on mon->peer_cnt in mon_timeout() - net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO - gve: Enable hw-gro by default if device supported - gve: add support for UDP GSO for DQO format - gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO - gve: fix TX drop when GSO MSS is too small for hw - gve: DQO: reject TSO packets with an out of range MSS - llc: fix skb UAF and leaks on llc_mac_hdr_init() failure - bridge: check llc_mac_hdr_init() return value in br_send_bpdu() - net/sched: sch_teql: fix shadowed err in __teql_resolve() - vlan: ensure sufficient headroom in vlan_dev_hard_header() - autofs: fix sbi->pipe file reference leak in autofs_kill_sb() - perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits - perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED - perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused - perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs() - perf/core: Fix a refcount leak in attach_perf_ctx_data() - sched/core: Account PSI IRQ time to the execution context, not the scheduling context - mptcp: return sk_wait_data() errors from recvmsg() - x86/mce: Fix hardware debug register corruption on task migration - x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 - virtio_net: copy zerocopy frags in start_xmit without NAPI - tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow - tcp: prevent collapsing skbs across boundary in rtx queue - sctp: discard the rest of the packet on a stale-cookie error - af_packet: fix integer overflow in prb_calc_retire_blk_tmo() - arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 - arm64: errata: match the target implementation CPU's own MIDR - ata: libata-scsi: bound the ATA passthru sense descriptor writes - bna: prevent IOC timer rearm during teardown - bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir - crypto: s390/hmac - Generate intermediate CV for API partial block handling - cgroup/pids: Restore pids.events notifications in local mode - fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT - fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga - writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes - workqueue: Fix NULL current_pwq deref in flush dependency check - writeback: report a Tasks-RCU quiescent state per cgwb drain pass - fsl/fman: Fix clk reference leak in read_dts_node() - ipe: fix use-after-free when auditing a newly loaded policy - ipe: protect the dm-verity root hash with RCU - ipv6: do not let ipv6_find_hdr() return an offset past the packet end - ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST - gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() - gpio: cdev: fix kernel stack leak to user-space in error path - gpio: zynq: fix runtime PM leak on request error path - llc: reserve device headroom for allocated frames - mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() - rds: ib: Clear the sg list when mapping an MR fails - drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() - drm/imagination: Fix page count for page table for map() interface - drm/i915: fix incorrect RCU teardown order - drm/i915/dp_mst: Fix configuring FEC for a disconnected stream - drm/i915/dp_mst: Fix configuring TUs for a disconnected stream - drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() - drm/amd/display: Bump frame warning limit for clang builds of dml - drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() - drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() - drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() - drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM - drm/nouveau: fix autosuspend cleanup during teardown - drm/nouveau: Fix bridge reference leak in nv1a_ram_new() - drm/nouveau: fix double-free in nvif_vmm_dtor - drm/nouveau: Fix gem reference leak in validate_init() - drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() - drm/nouveau: RCU-free the scheduler-containing nouveau_sched - drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() - drm/xe/vm: nuke PTs only after unlinking contested VMAs - drm/xe: harden adjust_idledly() against divide-by-zero and overflow - drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV - drm/xe: Keep walking on SVM eviction failure - drm/virtio: fix memory leak of fence event on execbuffer failure - drm/virtio: fix NULL pointer dereference on fence allocation failure - gpio: tps65219: Fix GPIO input value reads - gpio: tps65219: Use the variant-specific direction callback - gpio: tps65219: Fix TPS65214 GPIO direction programming - mm/hugetlb: preserve mremap address delta when skipping page tables - mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() - PCI: of_property: Omit bus properties without a subordinate bus - packet: use ubuf_info completion for TX_RING packets - HID: alps: fix use-after-free on input2 registration failure - HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard - HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() - net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() - net/mlx5e: advertise MACsec offload only when supported - net/mlx5e: fix swapped IPv6 IPsec policy masks - net/sched: reject IDR error pointers when deleting actions - net: airoha: npu: cancel wdt_work after releasing the WDT IRQ - net: arp: terminate device name before lookup - net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read - net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy() - net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry - net: openvswitch: conntrack: remove 'add_helper' dead code - net: openvswitch: conntrack: fix helper UAF due to extensions realloc - net: atl1c: fix soft lockup on out-of-range tpd_cons read - net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read - net: bridge: mdb: restart port group walk after deletion - net: ena: fix PHC cleanup on probe failure - net: ena: fix MMIO read buffer leak on probe failure - net: phy: micrel: Advance register data pointer in write loop - net: txgbe: fix FDIR filter restore for VF rules - net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist - net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() - netfilter: ip6t_rpfilter: reject routes without inet6_dev - netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read - netfilter: nf_tables: skip expired catchall elements on insert and delete - nfc: fix use-after-free in nfc_get_local_general_bytes - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() - nfc: port100: reject frames whose declared length exceeds the received data - nfc: trf7970a: power down on startup RX gain failure - scsi: libiscsi_tcp: Check the data direction of a Data-In PDU - parisc: Increase kernel stack size to 32kb - perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() - perf/core: Run sched_task() for PMUs with only CPU-wide events - pinctrl: single: free the IRQ on domain creation failure - pinctrl: sunxi: keep a shadow copy of the data register output latches - s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() - s390/cmf: Fix virtual vs physical address confusion - s390/pci: Fix leak of struct pci_dev reference in zpci_report_status() - s390/pci: Fix missing device lock in zpci_report_status() - s390/pci: Report SCLP status on error events when no pdev is associated - s390/pci: Don't report recovery success on skipped recovery - s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config - KVM: Ensure memory attributes xarray nodes are accounted to the caller's memcg - KVM: Don't treat reserved xarray entries as having memory attributes - KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV - KVM: SEV: Do cache maintenance on the source VM during intra-host migration - KVM: arm64: Fix AArch32 DBGBXVR<n> handling - KVM: arm64: Fix spurious warning for benign stage 2 teardown race - KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race - KVM: arm64: Transfer the hyp stack pages out of the host stage-2 - RISC-V: KVM: Synchronize hrtimer callback during teardown - RISC-V: KVM: Propagate interrupted G-stage faults - RISC-V: KVM: Fix HSM hart status error propagation - Bluetooth: hci_conn: fix CIS hold ownership on reuse - Bluetooth: hci_sock: validate event length before filtering - Bluetooth: hci_sock: reject out-of-range OCF values - Bluetooth: ISO: balance the parent hold in hci_bind_bis() - Bluetooth: ISO: release unused CIS holds after channel attach - Bluetooth: L2CAP: validate frame length before control and FCS access - Bluetooth: mgmt: fix race in read_unconf_index_list() - Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO - smb: client: fix create context out-of-bounds reads - smb: client: clean up failed cached directory opens - smb: client: preserve create-context parsing errors - smb: client: validate POSIX create context length - xfs: don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption - xfs: fix attr fork block count checks in xrep_inode_blockcounts - xfs: release orphanage dir inode if chown fails - xfs: use correct jiffies comparison function in xchk_maybe_relax - xfs: check padding field in xfs_ioc_commit_range - xfs: don't call xfs_exchange_range_finish for a dry run - xfs: use the correct reservations for rtrmap/refcount recovery - xfs: check di_forkoff correctly in scrub - xfs: fix rtgroup repair estimations - xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots - xfs: call xfs_dquot_set_prealloc_limits if we installed default rtb limits - xfs: don't let hidden_space go negative in xfs_metafile_resv_init - xfs: fix blockgc group quota scanning when usrquota isn't enforced - xfs: fix cursor and pointer handling when recovering iunlink buckets - net: tls: fix silent data drop under pipe back-pressure - cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict - vlan: require the MAC header to be present in __vlan_insert_inner_tag() - i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL - drm/i915/psr: Disable PSR2 on Xiaomi Book Pro 14 2026 as a quirk - drm/i915/quirks: Limit eDP rate to HBR2 on HP Pavilion Plus 14-ew1 - drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc() - drm/client: fix restore of partially initialized client - mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish - mm/hugetlb: do not dissolve gigantic pages without runtime support - super: make iterate_supers_type() deletion-safe - PCI: Fix BAR resize for devices on a root bus - HID: alps: unregister DualPoint Stick input device on remove - net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths - net: ipconfig: bound DHCP option construction - perf/x86/intel: Update event constraints and cache_extra_regsfor ADL - perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification - perf/x86/intel: Update event constraints and cache_extra_regsfor LNL - perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints - x86/sev: Remove redundant ghcbs_initialized checks around __sev_{get,put}_ghcb() - x86/sev: Make vTPM SVSM calls preemption-safe - net/sched: act_ct: fix helper UAF due to extensions realloc - net/sched: act_ct: avoid modifying shared unconfirmed ct entry - RISC-V: KVM: Serialize IMSIC attributes with vCPU migration - Revert "rust: net: phy: fix off-by-one bit positions in device status accessors" - rust: net: phy: fix off-by-one bit positions in device status accessors - mm/damon/core: fix unconditionally skip last region - sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags - rose: keep the route needed for routing loop detection - rose: guard rose_transmit_link() against a NULL neighbour - rose: use timer_shutdown_sync() for t0timer teardown - rose: don't warn on stray CALL_ACCEPTED/CLEAR_CONFIRMATION in state 3 - drm/amd/display: Remove sink usage from DPMS - KVM: s390: Fix _gaccess_shadow_fault() - KVM: s390: Add missing srcu in kvm_s390_set_irq_state() - KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key() - KVM: s390: Fix potential races in dat skey functions - KVM: s390: Fix race in _destroy_pages_crste() - bpf: Allow terminal gotox instructions - bpf: Fix u32 overflow issue in map batch operations - pinctrl: generic: serialise pinctrl_generic_dt_node_to_map() - RISC-V: KVM: Fix the conversion between vsip and hvip - KVM: arm64: Match hyp text by physical address in fix_host_ownership() - scsi: block: Fix zones_cond out-of-bounds write on zone report - block: Add bvec_folio() - netfs: Fix netfs_read_gaps() to use separate sink folios - netfs, afs: Fix symlink reading - net/mlx5: LAG, reload IB reps of LAG master before the rest - bpf: Make post-verification instruction rewrites killable - eth: fbnic: use the Rx queue napi pointer to find the napi vector - drm/xe/gt_throttle: Report power brake as a throttle reason on CRI - bpf: Reject non-negative offsets in stack_slot_obj_get_spi() - net: don't require the hwtstamp NDOs when a PHY provides timestamping - bpf: Reject pkt arguments in mutating subprogs - net: stmmac: selftests: Validate EEE based on the actual LPI timer value - net: stmmac: size the RX buffers from the frame length, not the MTU - net: dsa: mv88e6xxx: 88E6191X and 88E6193X have no PTP - net: ipv6: keep room for the mac header in dst_dev_overhead() - net/sched: act_ife: validate metadata length before decoding - bpf: Zero-fill other CPUs when BPF_F_CPU creates a per-cpu hash element - net: wangxun: implement soft quiesce for PCIe error recovery - net: libwx: fix races in Tx timestamp handling - net/rds: size a connection's path set by the transport it ends up with - net: flush skb_defer_nodes in dev_cpu_dead() - ovl: fix UAF in ovl_do_mkdir() debug print - perf/x86/intel: Delete dead NVL PEBS data-source initcall - perf/core: Fill branch entries with a single assignment - vsock: ignore empty child namespace mode writes - netfs: Fix missing alloc tagging of direct mempool allocations - kprobes: Fix permanent hang when flushing the kprobe optimizer - drm/amdgpu/userq: fix double jiffies conversion in hang detect timeout - drm/amdgpu/vcn4.0.3: fix video_timeout unit mismatch in jpeg reset wait - drm/amdgpu/vcn5.0.1: fix video_timeout unit mismatch in jpeg reset wait - drm/nouveau/dmem: pin VRAM for the whole registered range - mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold() - mm/damon/core: allow esz to be set to zero - mm/damon/core: reset invalid quota->charge_target_from - net: phy: intel-xway: workaround 100BASE-TX Link-Up issue - scsi: ufs: core: Keep internal commands dispatchable during error handling - parisc: parse early parameters in setup_arch() - perf/x86/intel: Fix Panther Cove PEBS data-source snoop states - perf/x86/intel: Remove incorrect Panther Cove PEBS data-source constraints - perf/x86/intel: Constrain Panther Cove UOPS_DISPATCHED events to PMCs 0-3 - pinctrl: mpfs-mssio: fix width of unused bank voltage setting - pinctrl: mpfs-mssio: use correct regmap function to set bank voltage - KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode - RISC-V: KVM: Release unused page after MMU invalidation - smb: client: close handle after create-context parsing failure - smb: client: use finish_no_open() for non-regular inodes - smb: client: close completed creates on compound wait errors - smb: client: delete compound mids on send failure before unlock - xfs: don't let memory failures leak blocks and kill repairs - xfs: don't merge different file IO error types - xfs: drop dquot flush lock when we can't find a buffer to flush - drm/xe: Add wa_14025941587 to xe2, xe3 and xe3p platforms - i2c: qcom-geni: Isolate serial engine setup - soc: qcom: geni-se: Add geni_icc_set_bw_ab() function - soc: qcom: geni-se: Introduce helper API for resource initialization - i2c: qcom-geni: Move resource initialization to separate function - i2c: qcom-geni: Store of_device_id data in driver private struct - i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL - drm/amd/display: Relax DML frame limit with UBSAN - KVM: arm64: nv: Fix life cycle of the nested_mmus array - KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction - KVM: x86: Reject nested CAP enablement if nested virtualization is disabled - accel/ivpu: Use threaded IRQ for IPC callback processing - accel/ivpu: Drop IRQF_ONESHOT to allow IPC IRQ threading on PREEMPT_RT - i2c: qcom-geni: release DMA channels on probe error - Upstream stable to v6.18.55, v7.2.9 * Resolute update: upstream stable patchset 2026-10-06 (LP: #2169641) - landlock: Fix TCP Fast Open connection bypass - selftests/landlock: Add test for TCP fast open - selftests/landlock: Use an actual chardev for MAKE_CHAR audit test - selftests/landlock: Add tests for whiteout object creation - selftests/landlock: Add audit test for whiteout object creation - sunvdc: fix -EIO issue due to lack of retries - media: video-i2c: fix buffer queue ordering - ipv6: Select best matching nexthop object in fib6_table_lookup() - ipv6: Honor oif when choosing nexthop for locally generated traffic - xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk() - xfrm: iptfs: fix runt reassembly panic from short inner tot_len - xfrm: fix compat ALLOCSPI request use-after-free - xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() - esp: downgrade zerocopy managed frags before mutating skb frags - ARM: socfpga: select the PL310 erratum 753970 workaround - RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept - RDMA/rxe: validate access flags before swapping the MR's PD - RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS - clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate - RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths - RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds - RDMA/mlx5: Remove warn on missing representor in query_port_speed - RDMA/core: Reject unregistering netdevs in ib_get_eth_speed - power: sequencing: Fix build issue with COMPILE_TEST - arm64: dts: renesas: r9a09g057: Switch GBETH TX queue scheduling to WRR - arm64: dts: renesas: r9a09g056: Switch GBETH TX queue scheduling to WRR - arm64: dts: renesas: r9a09g047: Switch GBETH TX queue scheduling to WRR - IB/iser: reject a remote invalidation of an unregistered direction - IB/isert: wait for deferred control PDU completions before releasing the connection - RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup - RDMA/mad: Fix receive buffer leak when PKey enforcement fails - RDMA/irdma: Enforce local fence for IB_WR_REG_MR - RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted - dmaengine: sprd: Fix runtime PM reference leak in probe - wifi: mac80211: include TIM bitmap control for buffered S1G mcast traffic - wifi: virt_wifi: free skb when disconnected - wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path - wifi: brcmfmac: cyw: pass PMKID to firmware if present - wifi: libipw: reject too-short beacon and probe responses - wifi: libipw: reject too-short association responses - IB/IPoIB: Avoid restoring OPER_UP after multicast flush - wifi: cfg80211: don't get the radio mask for netdev-less wdevs - wifi: cfg80211: check IP header size in cfg80211_classify8021d() - soundwire: cadence_master: wait and cancel cdns->work before clock stop - MIPS: Octeon: apply USB FDT fixups also when USB is modular - dma-coherent: report a failed reserved memory assignment - dmaengine: Fix device kref underflow in dma_chan_put() - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() - dmaengine: wait for RCU readers before releasing dma_device - wifi: cfg80211: don't free driver-owned scan requests - wifi: cfg80211: only group hidden BSSes with beacon entries - wifi: cfg80211: don't filter by BSS type when removing stale entries - wifi: mac80211: don't start a ROC while scanning - wifi: mac80211: don't warn when an IBSS has no channel to scan - wifi: mac80211: don't offload TC setup on AP_VLAN interfaces - wifi: mac80211: suppress chanctx warning for debugfs reset - wifi: mac80211: abort chanswitch when leaving a mesh - wifi: mac80211: reset state when starting AP fails - wifi: cfg80211: restore netns_immutable on failures - wifi: cfg80211: undo netns switch if renaming the wiphy fails - wifi: mac80211: unlist vifs when their netdev is unregistered - wifi: cfg80211: get the wiphy out of a dying network namespace - wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping - wifi: mac80211: don't allow injecting frames wider than the chanctx - wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown - wifi: mac80211: require a peer station for TDLS setup confirm - wifi: mac80211: don't allow link changes when iface is down - wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set - wifi: mac80211: don't access the TSF of a down interface - wifi: mac80211: add HE 6 GHz capability in the scan elems len - wifi: mac80211: mesh: reset the CSA state when leaving - wifi: mac80211: mesh: release the channel if start fails - wifi: mac80211: set up the TX info early to fix failure paths - mm: memblock: show all region flags in debugfs - scsi: qla2xxx: Fix the ql2xfc2target parameter description - dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order - dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA - RDMA/efa: Keep admin queues alive while IRQ is registered - RDMA/efa: Keep EQ resources alive while IRQ is registered - RDMA/siw: Bound fragmented header copies by the remaining length - drm/msm: Fix the separate_gpu_kms parameter description - drm/msm/adreno: Fix the skip_gpu parameter description - netfilter: nft_nat: fully initialise new_addr in netmap setup - netfilter: nf_tables: fix device name and prefix match in hook lookup - netfilter: nf_nat: unregister and release hooks on error - netfilter: flowtable: hold reference on ct until flow is released - perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations - arm64: hibernate: clone only the linear map that exists at runtime - drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr - keys: fix lost wakeup when reaping a dead key type - neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. - neighbour: Add missing RCU annotation for neightbl_dump_info(). - neighbour: Skip default parms when resumed in neightbl_dump_info(). - ALSA: bcd2000: Fix race between rawmidi and disconnect - phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow - phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting - ALSA: pcm: set timer->private_data before registering the PCM timer - drm/msm/dp: skip PUSH_IDLE when the link was never enabled - drm/msm/dp: fix link bandwidth check when wide bus is enabled - ASoC: Rename snd_soc_dai_link_ch_map.ch_mask to cpu_ch_mask - ASoC: Add codec_ch_mask to snd_soc_dai_link_ch_map - ASoC: soc-pcm: Apply snd_soc_dai_link_ch_map.codec_ch_mask to codec params - spi: spi-qpic-snand: avoid writing QPIC_EBI2_ECC_BUF_CFG register - Input: trackpoint - fix the inertia attribute name in the ABI document - gpio: virtuser: skip free_irq when no IRQ is installed - ALSA: usb: 6fire: Avoid embedded URBs - ALSA: 6fire: fix OOB write from device-reported iso length - wifi: virt_wifi: don't transfer operstate before register - drm/xe/mmio_gem: forbid VMA split - drm/xe/mmio_gem: use write-back mapping for dummy page - drm/xe/mmio_gem: Revoke drm_vma_node on xe_mmio_gem destroy - drm/xe/shrinker: Return the freed page count through a parameter - drm/vc4: Use managed KMS polling to fix UAF on unbind - ALSA: hda: trace PCM open only after assigning a stream - wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() - btrfs: tree-checker: print dev extent offset in error message - drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL - seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation - net: bcmgenet: convert RX path to page_pool - net: bcmgenet: restore the hardware filters on open - ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup - net: fddi: skfp: fix NULL deref when setting the MAC address while down - wifi: brcmfmac: fix lost 802.1x TX completion wakeup - net: bridge: mst: move switchdev call outside rcu - tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). - tcp: do not let tcp_rmem be set below 4096 - ksmbd: return buffer overflow for partial filesystem info - ksmbd: fix partial file information responses - ksmbd: keep compound responses on query info errors - dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained - Bluetooth: btintel_pcie: validate TX skb length in send_sync - Bluetooth: coredump: Quiesce dump work on unregister - Bluetooth: qca: Refactor code on the basis of chipset names - Bluetooth: qca: enable pwrseq support for WCN39xx devices - Bluetooth: hci_qca: Do not write to the serial port after it is closed - Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() - Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync - Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events - Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown - Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit - Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup - af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). - pppoatm: ensure a writable skb header and linear data - drop_monitor: synchronize tracepoint unregistration on error path - drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown - drop_monitor: fix out-of-bounds write in reset_per_cpu_data() - net: stmmac: do not overwrite phc_index when no PTP clock is registered - KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() - KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure - powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba - futex: Also allocate private hash on vfork() - btrfs: handle lack of space when cleaning up verity items - ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments - ASoC: hdmi-codec: Report a change when the channel status moves - ASoC: amd: acp: bounds-check SoundWire link ID in machine drivers - ASoC: sdw_utils: tidyup .count_sidecar - ASoC: sdw_utils: tidyup asoc_sdw_parse_sdw_endpoints() - ASoC: amd: acp: refactor codec config count in SOF SoundWire machine driver - ASoC: amd: acp: fix ffs() operator precedence for SoundWire link ID - net: netsec: fix device_node reference leak on phy_np - eth: fbnic: ring the doorbell if a burst ends in a drop - net: lock the socket in sock_gettstamp() - net: ethernet: cortina: Ack RX overrun interrupt correctly - net: stmmac: propagate FPE preemption-class mapping errors - net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() - x86/kprobes: Fix crash when probing CS CALL instructions - net: macb: fix ordering around PTP timestamp read - net: mvpp2: prevent buffer overflow in page_pool allocation - net: skbuff: do not leave stale header offsets after pskb_carve() - drm/amdgpu: check ras and obj before dereference - btrfs: abort transaction on failure to update inode for hole punching and reflinking - btrfs: check if there is space for chunk item when validating sys chunk array - x86/fred: Reconstruct the #GP context for rejected INT instructions - Input: eeti_ts - publish the OF module alias - hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler - hwmon: (hp-wmi-sensors) Improve raw WMI string handling - watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog - wifi: rtw88: TX QOS Null data the same way as Null data - Input: xpad - add support for Victrix Pro BFG Controller - Input: xpad - add support for Azeron devices - Input: xpad - fix PDP Marvel Xbox 360 controller - ALSA: core: Fix potential UAF after asynchronous card release - ALSA: virtio: reset device before deleting virtqueues - ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type - ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY - ata: libahci_platform: Fix device reference leak in ahci_platform_get_resources() - cifs: Fix server use-after-free in cifs_chan_skip_or_disable() - exec: Cleanup POSIX timers right after de_thread() - fs/dax: check zero or empty entry before converting xarray entry - phy: renesas: rcar-gen3-usb2: Avoid long delay in atomic context - posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list - rds: ib: use rds_conn_drop() on protocol version mismatch - rust: net: phy: fix off-by-one bit positions in device status accessors - Revert "nouveau/gsp: fix suspend/resume regression on r570 firmware" - drm/nouveau/gsp: Increase delay for magic sleep in r535_gsp_fini() - drm/nouveau/gsp/r570: Set GcOff = 0 in fbsr - drm/nouveau/gsp/r570: Enable S/R Display workaround in GSP - x86/build/64: Prevent native builds from generating EGPR use - [Config] Add and enable config setting RUSTC_HAS_APXF - x86/microcode/intel: Reject problematic loading on Granite Rapids systems - tcp: exclude old ACKs from tcp fast path - swiotlb: use the adjusted address for the highmem page lookup - spi: fsl-qspi: Reprogram the clock rate when the operation frequency changes - spi: spi-zynqmp-gqspi: stop the controller on shutdown - spi: virtio: Use the per-transfer bits per word - RDMA/ucma: Serialize join and leave on copy_to_user failure - RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() - openvswitch: avoid reallocating confirmed conntrack labels - net: xfrm: reject unrepresentable espintcp transport headers - HID: logitech-hidpp: fix race condition when accessing stale stack pointer - kselftest/arm64: Fix size of thread_data values for pthread_join() - arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc - arm64: dts: renesas: r8a779f0: Set UFS lane count - arm64: percpu: Fix this_cpu_write() casting - arm64: percpu: Fix this_cpu_and() mask generation - arm64: percpu: Fix LSE operations on {8,16}-bit types - Bluetooth: btusb: fix NXP IW610 composite device handling - Bluetooth: eir: validate service data length before reading UUID - Bluetooth: hci_codec: validate vendor codec count length - Bluetooth: hci_sync: Serialize local codec list cleanup - btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() - btrfs: clear free space tree creation state on rebuild failure - dmaengine: sun6i: fix non-atomic read of DMA position registers - dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status - dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() - ipv6: xfrm: use full sockets in local error paths - net: ip_tunnel: initialize `options_len` before referencing options - net: lan743x: fix RX checksum use-after-free - net: phy: mediatek: do not report link and per-speed LED rules together - net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() - net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain - net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value - net/sched: act_api: release tail references on DELACTION failure - net/sched: hhf: cap hh_flows_limit at change time - net/packet: clear RX owner on VNET header error - net/packet: avoid truncating TPACKET_V3 private size - scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() - xfrm: serialize state GC with device state flush - xfrm: use hlist_del_init_rcu for state_cache and state_cache_input - soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node - memcg: avoid charging the root memcg from obj_cgroup_charge_pages() - memstick: ms_block: destroy io_queue workqueue on removal - mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count - mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio() - mm/mremap: account mm->locked_vm correctly for MREMAP_DONTUNMAP - mm: filemap: retain mapped dropbehind folios - KEYS: encrypted: fix integer overflow of datablob_len - keys: translate request_key_auth pid for the reading procfs instance - KEYS: trusted: Fix tpm2_load_cmd() boundary check - i2c: at91: release DMA channels on remove and probe error - i2c: atr: fix dangling adapter pointer on add failure - i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() - i2c: imx: release DMA channels on probe error - i2c: imx: disable autosuspend on remove - IB/mlx4: Fix use-after-free on pkey sysfs registration failure - IB/hfi1: Resolve the credit-return buffer through the send context's node - IB/hfi1: Fix the PIO_CRED credit-return mmap - selinux: preserve user SID across nested backing files - selinux: recheck intermediate backing files on mprotect() - selinux: always fill AVC decision in avc_has_perm_noaudit() - power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed - power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() - power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() - mmc: core: Cancel SDIO IRQ work before freeing host - mmc: core: Fix OF node reference leak on card add failure - mmc: hsq: Fix use-after-free in retry work - mmc: mmci: Fix use-after-free in busy-timeout work - mmc: mxcmmc: cancel data work and watchdog on remove - mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 - mmc: sdhci-of-aspeed: Remove children before releasing SDC resources - mmc: sdio_uart: fix xmit_fifo leak when the port table is full - mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt - mmc: spi: reset bytes_xfered before retrying CRC failures - mmc: sdhci_am654: Move tuning_loop to local variable - mmc: sdhci_am654: Reset command and data lines on failed tuning - mmc: sdhci_am654: Clear ITAPDLY on tuning failure - mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure - Input: adp5588-keys - cache GPIO state before registering the gpiochip - Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 - Input: cyttsp5 - clamp the HID report size before memcpy - Input: evdev - zero absinfo before partial copy in EVIOCSABS - Input: hp_sdc - shut down kicker timer on module exit - Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P - Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() - Input: soc_button_array - fix MS Surface Pro 11 probe failure - Input: soc_button_array - check btns_desc->package.count - Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) - Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound - Input: zero ff_effect before compat copy in input_ff_effect_from_user - hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() - hwmon: (pmbus/core) increase number of phases and add new mask - hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding - hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 - hwmon: (pwm-fan) Stop RPM timer before freeing tach data - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove - hwmon: (w83793) release probe data through kref - hwmon: (cgbc-hwmon) Fix current sensors ID lookup - hwmon: (cgbc-hwmon) Add missing sensors - watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog - watchdog: digicolor: Avoid division by zero - watchdog: msc313e: Fix premature reset during timeout update - watchdog: msc313e: Propagate error code in resume() - watchdog: rtd119x: Avoid division by zero - watchdog: rzv2h: Avoid division by zero - watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() - watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() - wifi: brcmsmac: fix UAF in brcms_free_timer() - wifi: iwlegacy: fix broadcast stations deallocation - wifi: libertas_tf: fix UAF in lbtf_free_adapter() - wifi: rsi: fix heap OOB write on key removal - wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown - wifi: wlcore: release runtime PM ref on regdomain config failure - wifi: wilc1000: fix out-of-bounds read in P2P public action frames - wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() - wifi: p54: validate curve data length in the calibration curve converters - wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST - wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length - wifi: mwifiex: validate scan response extents - wifi: mwifiex: prevent authentication frame length truncation - wifi: mwifiex: validate action frame fixed fields - wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver - drm/gud: fix out-of-bounds write in gud_plane_atomic_check() - drm/gud: Ignore damage clips in full update mode - drm/msm/adreno: fix autosuspend cleanup during teardown - drm/msm/dpu: clear pending peripheral flush state - drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure - drm/msm: RCU-free the scheduler-containing ring and VM objects - drm/amdgpu: fix rmmio iounmap skipped on device removal - smb: client: cancel reconnect work in clean_demultiplex_info() - smb: client: fix rlist race and missing initialization - smb: client: fix use-after-free of iface in cifs_try_adding_channels() - smb: client: reject short Next offsets in parse_server_interfaces() - smb: client: fix smbd_connection leak on cifs_get_tcp_session() error - smb: client: fix unaligned access in WSL reparse point parser - smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs - smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() - smb: client: fix potential OOB read in smb3_enum_snapshots() - smb: client: fix server->total_read for compound encrypted PDUs - smb: client: fix missing lower-bound check on DFS referral string offsets - smb: client: fix missing iov bounds check in parse_posix_sids() - time/namespace: Export init_time_ns and do_timens_ktime_to_host() - ntsync: Honour caller's time namespace for absolute MONOTONIC timeouts - ntsync: reject wait ioctls with zero owner - ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity - signal: Prevent exec() race - xfrm: save input state data before secpath resets - mm/huge_memory: bypass THP tuneables for huge pfnmap mappings - 9p: Fix v9fs_issue_write() to update i_size and remote_i_size - mm/vma: correctly unaccount on mmap_prepare() failure - wifi: mac80211: refuse to make a monitor active when it has no queue - scsi: fnic: Rename fnic_scsi_fcpio_reset() - scsi: fnic: Bump up version number - scsi: fnic: Make debug logging protocol independent - scsi: fnic: Bump up version number again - scsi: fnic: Fix missed link-up when critical IRQ targets offline CPU - xfs: add a xfs_rmap_inode_owner helper - xfs: convert xchk_inode_xref_set_corrupt to xchk_ip_xref_set_corrupt - xfs: remove the i_ino field in struct xfs_inode - drm/amdgpu: hold a runtime PM reference for P2P dma-buf attachments - wifi: ipw2x00: Rename michael_mic() to libipw_michael_mic() - wifi: mac80211, cfg80211: Export michael_mic() and move it to cfg80211 - wifi: ipw2x00: Use michael_mic() from cfg80211 - wifi: libipw: reject TKIP frames without a full MIC - smb: client: fix reparse buffer bounds in cifs_query_reparse_point() - ksmbd: fix partial normalized name responses - Revert "ksmbd: Fix to handle removal of rfc1002 header from smb_hdr" - smb/client: send lease break ACKs thru correct session for multiuser mounts - xfrm: hold net_device reference under RCU in bundle creation - clk: scpi: register scpi-cpufreq once and clear on failure - RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency - arm64: dts: renesas: r9a09g077: Switch GBETH TX queue scheduling to WRR - arm64: dts: renesas: r9a09g087: Switch GBETH TX queue scheduling to WRR - RDMA/rtrs: guard against null kobj name - RDMA/uverbs: Fix potential leak of resources->collection in flow_resources_alloc() - RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables - mips: econet: fix unmet dependencies for ECONET - dma-mapping: don't trace the DMA address when the allocation fails - wifi: cfg80211: ibss: ref BSS entry for joined event - wifi: mac80211: reset the LED state when ifup fails - wifi: mac80211: only operate on TDLS peers in the TDLS code - scsi: pm80xx: Fix the use_msix, use_tasklet and read_wwn parameter descriptions - dmaengine: pxa: fix double counting of the hw descriptors - x86/div64: Fix addition of large constants in mul_u64_add_u64_div_u64() - arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation - smb: client: validate absolute native symlink targets before NT fixups - neighbour: Don't render blackhole_netdev via RTM_GETNEIGHTBL. - objtool: Validate disassembler headers in libopcodes probe - sysctl: Check range in proc_dointvec_ms_jiffies_minmax - Bluetooth: put the peer's on-air address on air when we cannot resolve - Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access - net: stmmac: fix TSO header length truncation - drop_monitor: use raw_cpu_ptr() in tracepoint probes - net: bridge: vlan: fix bugs caused by switchdev deletion errors - netlink: do not free nlk->groups while lockless readers can use it - Revert "drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable" - drm/xe/i2c: Disable IRQ on unbind - ASoC: cs-amp-lib: Prevent NULL pointer if efi variable is zero length - net/sched: codel: bound the dropping loop per dequeue call - net: do not advance stack index from dev_fwd_path() - net: airoha: Fix non-standard return value in airoha_ppe_get_wdma_info() - net: pass dst via net_device_path in dev_fill_forward_path() - net: pass net_device_path_ctx to dev_fill_forward_path() - net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check - net: prevent torn reads in netdev_tc_txq - net: stmmac: preserve real_num_tx_queues on mqprio setup failure - drm/amd/display: fix MALL hysteresis timer underflow at high refresh rates - perf: Fix null pointer access in is_include_guest_event() - Bluetooth: keep dst_type with dst when reusing an LE connection - gpiolib: Put fwnode reference on failure - dma-buf: Fix silent overflow for phys vec to sgt - dma-buf: Split sgl by largest page-aligned chunk - mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ - drm/amdkfd: Avoid integer underflow in EOP ring size calculation. - drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc - drm/amdkfd: implement restore_mqd callbacks for GFX12/12.1 - smb: client: fix WSL reparse point uid/gid override - smb: client: fix fattr leaking on wsl_to_fattr() failure - drm/ttm: fix swapped-out resources never leaving their bulk_move range - doc/netlink: netlink-raw: Add max check - selftests/bpf: Test bpf_cpumask_populate() rejects a borrowed cpumask - Upstream stable to v6.18.54, v7.2.8 * Resolute update: upstream stable patchset 2026-10-06 (LP: #2169641) // CVE-2026-98163 - cgroup: Avoid iteration of dying tasks with zero refcount * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) - drm/amd/display: Fix backlight max_brightness to match exported range - drm/amd/display: Scale custom brightness curve from full range - i3c: master: Fix device_register() error path - tracing/probes: ignore id update from btf_type_skip_modifiers - udf: Move udf_map_block() up - nvdimm: preserve flush callback -ENOMEM - tracing/probes: Fix BTF kflag check for anonymous struct member access - udf: Fix data loss when converting inline inodes to out of line - futex: Optimize futex hash bucket access patterns - nvdimm: pmem: keep PREFLUSH before data writes - nvdimm: virtio_pmem: stop allocating child flush bio - nvdimm: virtio_pmem: always wake -ENOSPC waiters - nvdimm: virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags - clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs - mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP - platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8DD6) - staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit() - dm-pcache: reject a kset that overruns its segment - dm-pcache: bound the logical key offset from persistent memory - KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported - KVM: x86: Extract REGS and SREGS runtime sync code to helpers - KVM: x86: Rename __{g,s}et_sregs2() => kvm_vcpu_ioctl_x86_{g,s}et_sregs2() - KVM: x86: Move the bulk of register specific code from x86.c to regs.c - KVM: x86: Check EFER validity on KVM_SET_SREGS* - Smack: Fix error in capability bypass - drm: Remove unused header in drm_dumb_buffers.c - drm: lcdif: Wait for vblank before disabling DMA - drm/bridge: synopsys: dw-dp: Set pixel mode by platform data - drm/rockchip: dw_dp: Simplify error handling - drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message - drm/rockchip: vop2: Fix wrong wait target in layer cfg done check - drm/rockchip: vop2: Wait for layer cfg done before switching LAYERSEL_REGDONE_SEL - drm/rockchip: analogix_dp: Enable hclk for RK3588 - drm/bridge: display-connector: don't autoenable HPD IRQ - drm/bridge: display-connector: trigger initial HPD event for DP - drm/rockchip: vop2: Add RK3576 to the RG swap special case - drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format - drm/bridge: cdns-dsi: Return an error pointer on allocation failure - drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure - smack: simplify write handlers of sysfs entries - smack: deduplicate smackfs/{direct,mapped} file_operations - smack: restrict smackfs/{direct,mapped} values to 0-255 - sched_ext/scx_flatcg: Fix cvtime_delta race and add hweight scaling to bypass charging - x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE() - selftests: proc: include fcntl.h in proc-pidns - HID: nintendo: Fix imu_timestamp_us double increment per report - soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() - media: cec-pin: Fix event FIFO ordering - cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox() - clk: versaclock7: Fix APLL clock leak on probe failure - clk: moxart: remove unused variables, fix refcount leak - clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation - clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc - clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic - clk: stm32: add missing bitfield.h header - clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller - ARM: imx: fix device_node refcount leak in imx_src_init() - ARM: imx: fix device_node refcount leaks in imx7_src_init() - arm64: dts: imx93-kontron: set memory node to 0x80000000/1GiB - clk: imx: scu: drop redundant init.ops variable assignment - mm/mm_init: fix incorrect node_spanned_pages - perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails - pinctrl: bcm2835: Don't remove an unregistered GPIO chip - riscv: kexec_file: Fix crashk_low_res not exclude bug - media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define - media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define - wifi: ath12k: correct monitor destination ring size - perf test: Drain pipe after child finishes to avoid losing output - perf test: Refactor parallel poll loop to drain all pipes simultaneously - perf test: Show snippet failure output for verbose=1 - perf test: Add summary reporting - perf test: Fix subtest status alignment for multi-digit indexes - perf test: Add -j/--junit option for JUnit XML test reports - perf test: Truncate printed test descriptions dynamically to avoid terminal wrapping - perf test: Truncate test description to fit terminal width - perf tests: Skip metrics validation if system-wide recording lacks permission - perf tests: Add robust record retry helper and use subsecond workloads - perf tests: Fix flakiness in trace record and replay test - perf test: Fix perf stat --bpf-counters on hybrid machines - perf tests: Fix flakiness in BPF counters test on hybrid systems - perf test: Fixes for check branch stack sampling - perf tests: Fix flakiness in branch stack sampling tests - regulator: tps6594: Fix device node reference leaks in multiphase loop - tools/bpf/bpftool: Reset vmlinux BTF after map commands - tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands - selftests/bpf: Mask socket type flags in mptcpify prog - mm: name the anonymous MMOP enum as enum mmop - dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure - dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe - soundwire: qcom: Fix port exhaustion check in stream_alloc_ports - iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure - selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check - wifi: rtw89: check return values in rtw89_ops_start_ap() - wifi: rtw89: fix HE extended capability length check - fanotify: initialize permission event watchdog state - tools/nolibc: mark arg1 operand in __nolibc_syscall0() as write-only - perf cs-etm: Fix thread leaks on trace queue init failure - perf/x86/amd/uncore: Add group validation - perf vendor events amd: Update Zen 5 core events - RDMA/irdma: Deduplicate the irdma_del_memlist logic - RDMA/irdma: Add a refcount to track user ring MR associations - RDMA/irdma: Add irdma_cq fields to track pbl allocations - arm64: dts: qcom: sm8750: wire UFS to ice instance - nvmet-rdma: factor out response resource cleanup - bus: ti-sysc: Fix /chosen node reference leak - PM: sleep: Fix off-by-one in wakelocks number limit check - arm64: dts: qcom: sc8280xp-blackrock: switch to uefi rtc offset - arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name - arm64: dts: qcom: hamoa: Fix clocks for HSPHYs - clk: qcom: gcc-glymur: Move EVA clocks to critical clock list - bus: qcom-ebi2: Fix clock leak on probe failure - staging: greybus: audio: correct sscanf() return value check - staging: sm750fb: gate dualview dataflow using g_dualview - staging: sm750fb: Add missing Kconfig dependency - greybus: audio: bound the topology section sizes against the fetched size - staging: fbtft: Use sysfs_emit_at() to print to sysfs file - staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown - staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown - staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions - staging: octeon: replace pr_warn with dev_warn in fill and rx paths - staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown - staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() - ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() - selftests/bpf: Fix memory leak in msg_alloc_iov error path - selftests/bpf: Fix memory leak in msg_alloc_iov - selftests/lsm: Fix memory leak in attr_lsm_count - irqchip/gic-v3-its: Fix memleak in its_probe_one() - irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its() - selftests: timers: leap-a-day: Fix -w option and update usage comment - clocksource: Unregister subsystem on device registration failure - timekeeping: Unwind aux clock sysfs children on failure - timers/migration: Fix memory leak in tmigr_setup_groups() error path - vdso/timens: Move functions to new file - timens: Add a __free() wrapper for put_time_ns() - timens: Simplify some calls to put_time_ns() - y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 - timekeeping: Account for monotonicity adjustment in ntp_error - arm64: dts: qcom: Add #{address,size}-cells to Chromium-based /firmware - clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status - clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains - arm64: dts: qcom: sc8280xp-arcata: Fix top USB-C DP alt mode - arm64: dts: qcom: sc8180x-primus: Rename regulator nodes - arm64: dts: qcom: sc8180x-primus: Describe the display power net - arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes - arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power net - clk: qcom: gcc-qcs8300: Use retention for PCIe power domains - clk: qcom: gcc-qcs8300: Use retention for USB power domains - perf data convert json: Fix trace_seq memory leak in process_sample_event() - staging: media: ipu7: fix pm_runtime refcount leak in ipu7_init_fw_code_region_by_sys() - usb: typec: ucsi: unregister debugfs entries on teardown - bpftool: Check EVP_Digest when computing excl_prog_hash - perf vendor events amd: Reintroduce deprecated Zen 5 core events - perf dso: Fix kallsyms DSO detection with fallback logic - efi: fix stale reference to efi_recover_from_page_fault() - iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX - bpf: Fix security_bpf_map_create error handling - iommu/msm: Return -ENOMEM on memory allocation failure in probe - iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors - iommu/amd: Add support for Hygon family 18h model 4h IOAPIC - iommu/amd: Fix false positive in SB IOAPIC IVRS validation - leds: pca9532: Fix inverted GPIO output polarity - leds: st1202: Stop pattern sequence before reprogramming - leds: st1202: Fix pattern duration prescaler and pattern_clear skip marker - leds: st1202: Fix spurious pattern sequence start in setup - leds: st1202: Set all pattern PWM slots to full after clearing pattern - leds: st1202: Fix brightness having no effect while pattern mode is active - leds: st1202: Disable channel when brightness is set to zero - leds: st1202: Validate LED reg property against channel count - ACPI: RISC-V: Fix riscv_acpi_irq_get_dep() loop termination - platform/x86: lg-laptop: Drop debug-only ACPI notify handler - platform/x86: lg-laptop: Convert ACPI driver to a platform one - hwspinlock: propagate errno when registering single lock - selftests/sched_ext: Fix bpf_link leak on early return in prog_run - perf capstone: Fix kernel map reference count leak - spi: qcom-geni: Fix missing error check on pm_runtime_get_sync() - serial: core: Add dedicated uart_port field for console flow - serial: Replace driver usage of UPF_CONS_FLOW - serial: 8250: Set cons_flow on port registration - serial: 8250: Add support for console flow control - serial: 8250: Clear CON_PRINTBUFFER on port re-registration - serial: ma35d1: Fix OF node reference leaks in console init - usb: mtu3: allow system suspend during active gadget connection - usb: renesas_usbhs: Fix power-off ordering on unbind - usb: ucsi: huawei_gaokun: support mode switching - usb: typec: ucsi: gaokun: unwind notifier on UCSI register failure - drm/panel: samsung-s6d16d0: Power off on prepare failure - perf metricgroup: Fix metric expression copy leaks - soc: qcom: rpmh-rsc: manage PM notifiers with devres - bus: qcom-ebi2: use managed resources for clocks and children - wifi: rtw89: mlo: rearrange MLSR link decision flow - wifi: rtw89: phy: support per PHY RX statistics - wifi: rtw89: 8852a: fix RSSI report when average beacon RSSI is not ready - iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE - drm/msm/dp: add missing drm_edid_connector_update() before add_modes on cached EDID - Revert "drm/msm: dsi: fix PLL init in bonded mode" - crypto: ccp - Fix memory leak in SEV INIT_EX path - hwrng: ks-sa - Fix runtime PM cleanup on registration failure - ALSA: hpi: Check transport errors during HPI6000 adapter initialization - pmdomain: bcm: bcm2835: handle genpd provider registration errors - misc: rtsx_usb: avoid USB I/O in runtime autosuspend - RDMA/hfi1: Stop flushing the global IB workqueue - RDMA/hfi1: Initialize debugfs after probe completes - ASoC: apple: mca: increase SERDES reset delay - iommufd/selftest: Avoid selftest dirty bitmap size wrap - perf zstd: Fix compression error path in zstd_compress_stream_to_records() - perf record: Return the written size from process_comp_header() - perf record: Fix multiple PERF_RECORD_COMPRESSED2 records per push - iommufd: Simplify iommufd_device_remove_vdev() - cxl/memdev: Fix firmware upload exact-fit handling - cxl/pci: Honor -EPROBE_DEFER from component register setup - cxl/port: Restart port enumeration when a sibling adds the dport first - wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate - x86/entry/fred: Encode frame pointer on entry - firmware: arm_scmi: Use channel ID for transport teardown - firmware: arm_scmi: Protect device request lookup with RCU - regulator: adp5055: Fix error code in adp5055_of_parse_cb() - tools/sched_ext: scx_qmap: Fix stale API name in comment - libnvdimm/labels: Bound the on-media label size before the shift - cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() - PCI: xgene: Drop unnecessary OF node reference - media: i2c: rdacm21: Fix missing media_entity_cleanup() - drm/amd/display: Remove unused-but-set variable hubp from - cpufreq: intel_pstate: Fix setting minimum P-state at init time - cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() - remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev - perf: evsel: Fix error handling in tp_format lookup - arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO - arm64: dts: qcom: sc8280xp-x13s: Fix the drive-strength of mclk pin - arm64: dts: qcom: ipq5018: Correct CMN PLL reference clock rate - arm64: qcom: ipq5018: Add GEPHY RX and TX clocks - arm64: dts: qcom: sm8250: sort out Iris power domains - arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table - perf jevents: Add more components to the metric sorting order - clk: qcom: gcc-glymur: Enable runtime PM - soc: renesas: r8a78000: Drop duplicate "default ARCH_RENESAS" - spi: geni-qcom: Fix sticky ret causing wrong return value on invalid proto - wifi: iwlwifi: mei: pass correct argument to function - gpu: host1x: Fix offset calculation in trace_write_gather - drm/msm/a6xx: Fix stale rpmh votes after suspend - drm/msm: Recover HW before retire hung submit - drm/msm/a6xx: Fix A663 GPUCC register list for state capture - drm/msm/a6xx: Fix A621 GPUCC register list for state capture - crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping - ACPI: processor: idle: Expand _LPI package sanity checks - tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 - staging: rtl8723bs: remove multiple blank lines in core/ - staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths - gpib: Move stuck SRQ update under lock - accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() - misc: rtsx: add missing write register handling - misc: lan966x_pci: depopulate children on populate failure - cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) - ppdev: prevent overflow when setting port timeout - char: xilinx_hwicap: unregister class on init errors - mtd: intel-dg: Fix runtime PM error path in probe - perf ui hists: Fix uninitialized stack memory free on pstack allocation failure - driver core: soc: Unregister bus on early device registration failure - drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg - dmaengine: dw-edma: Clear stale requests on termination - phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe - phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe - arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins - arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe - RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters - kcsan: avoid unintended access checking in NMIs - arm64: dts: imx8-ss-audio: Fix LPCG clock indices for ASRC0 - x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist - selftests/bpf: Check malloc result with ASSERT_NEQ in test_sha256 - selftests/bpf: Silence array bounds warning in global_map_resize - ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer - ext4: fix circular lock dependency in ext4_ext_migrate - ext4: skip extra isize expansion during mount to prevent deadlock - platform/x86: acer-wmi: reject missing gaming WMI results - libbpf: Search /lib64 and /lib in resolve_full_path() - ACPI: battery: Adjust charging status validation check - virt: arm-cca-guest: use migrate_disable() for attestation token requests - bpf: Mark bpf_refcount field as unique - RDMA/srpt: Pass the mapped task attribute to target_init_cmd() - PCI: j721e: Fix incorrect max_lanes for J7200 - RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations - RDMA/core: Fix potential use after free in uverbs_free_dmah() - iommu/qcom: Remove sysfs device on probe failure path - iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() - iommu/arm-smmu-v3: Declare eats_s1chk and eats_trans as host-endian u64 - wifi: ath12k: switch to name-based reserved memory lookup - wifi: ath12k: refactor QMI memory assignment - wifi: ath12k: allocate HOST_DDR and BDF regions after Q6 RO region - wifi: ath12k: Correctly copy the hint BSSID in WMI scan request - wifi: ath11k: Correctly copy the hint BSSID in WMI scan request - ARM: dts: allwinner: a10: Fix PMU interrupt - amd-pstate: Make certain freq_attrs conditionally visible - cpufreq/amd-pstate: Add dynamic energy performance preference - cpufreq/amd-pstate: Add support for platform profile class - cpufreq/amd-pstate: Fix EPP return type and handle errors during initialization - cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems - riscv: dts: spacemit: k1: Split gmac_clk_ref into independent pinctrl groups - perf cs-etm: Flush thread stacks after decoder reset - perf cs-etm: Avoid truncating AUX buffer sizes to int - PM: hibernate: Fix memory leak in snapshot_write_next() error path - leds: pca9532: Fix phantom device registration on missing hardware - perf cap: Remove used_root parameter and simplify capability checks - drm/tve200: add OF module alias for autoloading - netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet - drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() - arm64: dts: rockchip: Add missing hclk for RK3588 eDP0 - arm64: dts: rockchip: Add missing hclk for RK3588 eDP1 - arm64: dts: rockchip: Fix Gru WLAN sideband interrupt - arm64: dts: rockchip: Fix rk3566-bigtreetech-cb2 touchscreen property - ARM: lpc32xx: only run SoC init on LPC32xx hardware - selftests/bpf: Fix incorrect error checking for pthread_create - selftests/bpf: Fix memory leak on subtest_states reallocation - tools/build: Allow versioning of all LLVM tools defined in Makefile.include - arm64: RSI: fix field-spanning write warning in attestation token init - power: supply: sbs-battery: Use a per-device serial number buffer - crypto: keembay - publish OF module alias for OCS AES/SM4 - thermal/drivers/airoha: Fix copy paste error on clamp_t low temp - thermal/drivers/airoha: Fix copy paste error for sen internal - thermal/drivers/qcom-spmi-adc-tm5: Drop IIO_VAL_INT check in adc_tm5_get_temp - powercap: intel_rapl_tpmi: Handle PMU registration failure during probe - clk: mediatek: mt6735: Unregister PLLs on probe failure - w1: ds2482: Fix signedness bug in ds2482_w1_triplet() - cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf - remoteproc: Allow shutdown of crashed processors - remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() - staging: rtl8723bs: use kfree_sensitive() for key material - RDMA/efa: Fix PBL chunk length computation - wifi: mac80211: fix per-STA profile length in cross-link CSA parsing - arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix - clk: tegra: tegra124-emc: put EMC node on register failure - clk: palmas: Manage external-control prepare with devm - clk/x86: pmc_atom: add kasprintf return value check - clk: mediatek: mt8135: Fix inverted gate control for devapc_ck - clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs - scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. - RDMA/mlx5: Send cong param changes to the resolved port mdev - media: staging/ipu7: fix async notifier leak on init error - wifi: ath12k: validate TLV length in process_tpc_stats() - PCI: starfive: Fix Runtime PM handling and teardown ordering - PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe - drm/msm: remove objects from evit list after pinning them - media: qcom: iris: Fix bitmask test in iris_allow_cmd() - platform/chrome: cros_ec_debugfs: Clean up console log on probe failure - bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET - md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency - md/raid5-ppl: fix use-after-free in ppl_do_flush() - md/raid5: protect lockless recovery_offset accesses during reshape - fanotify: stop permission watchdog when timeout is zero - tools/nolibc/powerpc: mark ctr and xer as clobbered by system call - selftests/zram: fix kernel_gte() for POSIX sh - Revert "serial: 8250: Clear CON_PRINTBUFFER on port re-registration" - md/raid10: consistently fail atomic writes that require splitting - rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs - arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep - arm64: dts: qcom: msm8976-longcheer-l9360: Fix accidental node override - arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property - arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes - clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration - arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en - firmware: qcom: scm: add trace events for the SMC call interface - firmware: qcom: scm: instrument SMC call path with tracepoints - firmware: qcom: scm: Fix reserved memory cleanup on probe failure - firmware: qcom: scm: Fix tzmem state on probe retry - block: don't set BIO_QUIET for BLK_STS_AGAIN - block: add a bio_endio_status helper - arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID - clk: qcom: gpucc-qcm2290: Park RCG's clk source at XO during disable - clk: qcom: Return expected ENOMEM error on dynamic allocation failure - md: remove unused mddev argument from export_rdev - md: skip redundant raid_disks update when value is unchanged - i3c: master: adi: add OF module alias for autoloading - fs: annotate inode timestamp accessors - locking/lockdep: Fix NULL pointer dereference in __lock_set_class() - powerpc: implement get_direction() in cpm2 - powerpc/44x: Set GPIO chip parent - powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr() - misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() - fanotify: report full event length for FIONREAD - wifi: mt76: connac: add MT7991A (0x7991) to is_mt7996() - wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 - wifi: mt76: always enable RRO queues for non-MT7992 chipset - wifi: mt76: mt7925: update clc before setting sar power table - wifi: mt76: mt7925: fix msg len mismatch between driver and firmware - wifi: mt76: mt7996: fix EAPOL source BSS for non-MLD stations - wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU - wifi: mt76: mt7996: set specific BSSINFO and STAREC commands after channel switch - wifi: mt76: mt7996: fix out-of-bounds array access during hardware restart - wifi: mt76: assign link_id when sending probe request during scan - wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset - wifi: mt76: mt7996: don't report a zero TX bitrate - wifi: mt76: mt7915: write RX header translation bit to the correct register - wifi: mt76: fix stranded frames in mt76_txq_schedule_pending - wifi: mt76: fix uninitialised RXDMAD_C descriptor info - wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie - wifi: mt76: check txfree done event on the WED hw path - wifi: mt76: mt7996: don't leak MLD group index on remap alloc failure - wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields - wifi: mt76: mt7996: add missing rdd_idx check when enabling background radar - wifi: mt76: only consume the WO drop bit on WED v2 devices - drm/msm/dp: reject YUV420-only modes without VSC SDP support - drm/msm/dp: do not reject wide-bus modes while a YUV420 mode is active - perf: arm_spe: Make wakeup range check overflow safe - drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) - drm/msm/dp: Drop dev_pm_opp_set_rate(0) - perf machine: Fix fd leak on bounds check in maps__set_modules_path_dir() - perf machine: Fix NULL parent dereference in fork event processing - perf machine: Guard against NULL strlist in machines__findnew() - perf machine: Check snprintf truncation in machines__findnew() - perf machine: Don't abort guest map creation on first inaccessible dir - perf machine: Reset errno before strtol in guest kernel map creation - perf machine: Free scandir entries in guest kernel map creation - perf machine: Check snprintf truncation for guest kallsyms path - wifi: mt76: mt7996: skip key upload when adding an offchannel link - wifi: mt76: mt7996: wake MCU waiters before aborting scan in L1 SER - wifi: mt76: mt7996: fix MIB TX aggregation counter registers for mt7990 - wifi: mt76: mt7996: fix reg addr remap when addr is 0 - wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 - wifi: mt76: mt7915: report RX chain signal for all RX paths - wifi: mt76: fix queue assignment for disassoc packets - wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band - wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum - wifi: mt76: mt7996: remove beacon_int_min_gcd from ADHOC interface combinations - arm64: smp: Fix IPI teardown for GICv5 flow - arm64/fpsimd: ptrace: Fix inactive SVE and SSVE regsets - kselftest/arm64: fp-ptrace: Fix checks for inactive SVE and SSVE regsets - kselftest/arm64: Don't write to P0 in irritator on SME only systems - iommu/arm-smmu-v3: Convert to use atomic poll timeout - perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register - wifi: mac80211: send TWT teardown to peer after setup TX failure - wifi: zd1211rw: reject secondary interfaces to prevent conflicts - wifi: mac80211: skip unused probe response countdown offsets - wifi: nl80211: refactor nl80211_parse_chandef - wifi: cfg80211: Add an API to configure local NAN schedule - firmware: google: Add bounds checks in coreboot_table_populate() - pinctrl: eswin: Fix Handling of PIN_CONFIG_PERSIST_STATE - pinctrl: spacemit: validate pins in pinconf callbacks - powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass - powerpc/irq: Fix missing r2 clobber in PCREL inline assembly - soc: fsl: qe: properly scan GPIO nodes at startup - soc: fsl: qe: implement get_direction() - MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL - serial: amba-pl011: unprepare console clock on unregister - misc: pci_endpoint_test: Check SUCCESS bit for doorbell status - HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver - HID: i2c-hid: Fix "(null)" output when reading report descriptor fails - HID: steam: Refactor and clean up report parsing - HID: steam: Rename some constants that got renamed upstream - HID: steam: Add support for sensor events on the Steam Controller (2015) - HID: steam: Improve logging and other cleanup - HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure - HID: lg4ff: validate report length before fixed offsets - perf thread-stack: Fix heap buffer overflow on branch stack wrap copy - perf auxtrace: Fix queue grow overflow and old array leak - perf intel-pt: Fix off-by-one in auxtrace_info minimum size check - perf intel-bts: Fix off-by-one in auxtrace_info minimum size check - perf arm-spe: Reject zero nr_cpu in metadata to prevent division by zero - iio: light: tsl2772: fix ALS calibscale readback - iio: light: isl29028: return zero in write_raw() on success - iio: light: tsl2583: return zero in write_raw() on success - net: stmmac: Skip PHY attach if custom PCS is in use - block/blk-stat: drain per-cpu callback stats over possible CPUs - block/blk-iocost: collect per-cpu latency stats over possible CPUs - block/kyber-iosched: flush per-cpu latency buckets over possible CPUs - ublk: check for ublk_unmap_io() returning 0 - lib/string: fix memchr_inv() for large ranges - pps: don't try to wait for negative timeouts in PPS_FETCH - pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler - pps-gpio: remove dead capture_clear code - riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller - arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC - remoteproc: Move resource table data structure to its own header - remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() - selftests/mm: ksm_tests: use kselftest framework - selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes - selftests/mm: fix ternary operator precedence in ksm_tests - arm64: dts: qcom: sc8280xp-blackrock: Fix swapped USB QMP PHY vdda- phy/vdda-pll supplies - arm64: dts: qcom: qcs8550-aim300: Fix swapped USB QMP PHY vdda-phy/vdda- pll supplies - arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda- phy/vdda-pll supplies - arm64: dts: qcom: sar2130p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - intel_idle: Avoid using deep idle states during initialization - scripts/tags.sh: Prevent binary files appearing in cscope.files - modpost: prevent leak when early return no suffix .o in read_symbols() - kbuild: fix modules.builtin(.modinfo) targets in the top-level Makefile - perf libbfd: Validate BPF prog info arrays before pointer cast - perf bpf: Add PROG_TAGS to required arrays in __bpf_event__print_bpf_prog_info() - perf libbfd: Fix memory leaks and NULL fclose in BPF disassembly - clk: rockchip: rk3576: fix source muxes for SPI0..SPI4 - drm/sun4i: vi scaler: Fix coefficient selection - drm/sun4i: tcon: Set output mux for DSI and LVDS - drm/sun4i: hdmi: Don't leak sync polarity bits into packet control - drm/sun4i: tcon: Drop remote endpoint reference - drm/sun4i: dw-hdmi: Drop TCON TOP port reference - drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz - rust: cpufreq: Add CPUFREQ_TABLE_END as last table entry in TableBuilder::to_table - rust: cpufreq: Fix temporary write in Registration::bios_limit_callback - module: use strscpy() to copy module names in stats and dup tracking - module/dups: Inform duplicate requests about the result directly - RDMA/erdma: restrict the driver to little-endian systems - [Config] Disable CONFIG_INFINIBAND_ERDMA on s390x - wifi: mac80211: skip default WMM setup for AP_VLAN links - arm64: hibernate: mask DAIF before restoring hibernated kernel - mfd: rave-sp: validate received frame payload lengths - mfd: iqs62x: Reject zero-length firmware records - mfd: macsmc: Fix key count endianness annotation - leds: gpio: Clear error pointers for skipped LEDs - drm/amdgpu/gfx6: Fixup emit_cntxcntl() - ext4: fix spurious message about orphan cleanup on RO fs - arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node - phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator - phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table - perf trace-event: Fix buffer overflow in read_string() - drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets - pinctrl: rockchip: Reset the pin count when recalculating SoC data - soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() - phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*() - phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads - phy: qcom: qmp-pcie: Add pcs_lane1 offset to V5 offsets - md: avoid stale clone I/O accounting timestamps - coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() - coresight: etm4x: fix leaked trace id - bpf, riscv: Add and use bpf_atomic_is_load_acq() helper - bpf, x86: Fix exception table metadata for arena load-acquire - bpf, arm64: Fix exception table metadata for arena load-acquire - regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling - ACPI: video: Release PCI device reference after lookup - perf/x86/intel/pt: Factor out pt_config_enable() - perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED - perf/x86/intel/pt: Fix stop/start with no update - sched/fair: Also gate overloaded status update for SD_ASYM_CPUCAPACITY - sched/fair: Check CPU capacity before comparing group types during load balance - Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event - Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() - Bluetooth: btusb: refactor endpoint lookup - Bluetooth: btusb: Record matched usb_device_id into btusb_data - Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices - perf trace-event: Fix integer truncation in do_read() and skip() - scsi: sd: Fix sd_done() sense handling condition - btrfs: use aligned range for locking in extent_fiemap() - btrfs: avoid GFP_ATOMIC allocations in qgroup free paths - pinctrl: airoha: fix mdio bitfield names - pinctrl: airoha: an7581: fix pinconf of i2c_scl/i2c_sda pins - pinctrl: airoha: an7583: fix I2C0_SDA_PD register bit order - pinctrl: airoha: an7581: fix mux/conf of pcie_reset pins - pinctrl: airoha: an7583: fix muxing of non-gpio default pins - pinctrl: airoha: an7583: fix spi group pins - pinctrl: airoha: add missed get_direction() function for gpio_chip - pinctrl: airoha: fix getting gpiochip/pinctrl pointers in the IRQ handling code - pinctrl: airoha: fix IRQ mask/unmask code - pinctrl: airoha: fix edge-triggered interrupts handling - Bluetooth: btintel: Fix diagnostics event detection - mmc: sdio: add MediaTek MT7902 SDIO device ID - Bluetooth: btmtk: add MT7902 MCU support - Bluetooth: btmtk: add MT7902 SDIO support - Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative - iio: light: opt4060: Fix pointer type passed to div_u64_rem() - iio: light: gp2ap002: re-enable irq if runtime suspend fails - riscv: cpufeature: Clarify ISA spec version for canonical order - bpf: Factor out stack_map build ID helpers - bpf: Avoid faultable build ID reads under mm locks - i3c: renesas: Return immediately if there is no transfer - i3c: renesas: Follow a unified pattern for transfer and command initialization - i3c: renesas: Don't register devices when ENTDAA times out - arm64: dts: turris-mox: fix usb3 phys - ARM: dts: helios4: add vcc-supply to EEPROM - ARM: dts: helios4: add vcc-supply to GPIO expander - ARM: dts: helios4: add SATA regulator supplies - perf stat: Fix evsel_list leak in cmd_stat - perf synthetic-events: Fix uninitialized pthread_join - perf test: Support dynamic test suites with setup callback and private data - perf test: Fix skiplist leak in cmd_test - perf python: Check counts_values size in set_values - perf python: Handle Py_None for thread and cpu maps - perf python: Validate CPU and thread maps in pyrf_evsel__open - perf python: Fix memory leak in pyrf__metrics_cb - perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads - fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() - fbdev: clps711x-fb: Remove unreachable unregister_framebuffer() call - iommu/vt-d: Fix UCTP context table slot when copying root entries - crypto: qat - use 2-arg strscpy where destination size is known - crypto: qat - remove dead ADF_HEX code - hwrng: imx-rngc - Disable clock on registration failure - m68k: Fix backtraces for non-running tasks - xdrgen: Do not declare union XDR functions in the definitions header - xdrgen: Fix opaque and string encoders for unbounded members - arm64: Disable KCSAN instrumentation in delay.o - hwmon: (cros_ec) Register the thermal devices after the hwmon ones - hwmon: (cros_ec) Store the hwmon device in cros_ec_hwmon_priv - hwmon: (cros_ec) Synchronize EC access from the thermal device callbacks - nvmet: fix Reservation Register Replace for unregistered host with IEKEY - nvmet: propagate percpu_ref_init() failure in nvmet_ns_enable() - cgroup/cpuset: Use WRITE_ONCE() for shared prs_err updates - selftests/sched_ext: Check skeleton open failure in exit test - powerpc/configs: enable CONFIG_RAS to fix EDAC support - iommu/amd: Fix incorrect device ID in invalid PASID error message - rust: uapi: replace direct asm-generic/ioctl.h include with linux/ioctl.h - phy: renesas: rcar-gen3-usb2: Ignore missing VBUS regulator - phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs - phy: qcom: qmp-combo: Drop qmp_v4_calibrate_dp_phy - spi: sprd-adi: Fix probe succeeding without registering the controller - ASoC: qcom: q6apm: keep the graph start count in sync with the DSP - arm64: bti: Disable in-kernel BTI with recent versions of Clang - integrity: Make arch_ima_get_secureboot integrity-wide - s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT - s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN - nvme: Add the DHCHAP maximum HD IDs - nvme-apple: Don't set a DMA direction for commands without a data transfer - nvme-apple: Never set the opcode in the NVMMU TCB - nvme: Add a quirk for page aligned admin queue buffers - nvme-apple: Require page aligned buffers on the admin queue - nvme-apple: Drop the PRP null check chicken bit - nvme: reject passthrough of driver-managed Set Features - nfc: digital: Do not dump a NULL response in command completion - dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal - ice: fall back to SBQ when LL PHY timer interface times out - ice: clear the default forwarding VSI rule when releasing a VSI - idpf: add missing cpu_to_le32 in idpf_tx_splitq_build_flow_desc - ASoC: pxa: Use devm_clk_get_optional() for extclk clock - ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready - UBI: Preserve torture flag when rescheduling failed erasures - UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs - UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC - firewire: core: add KUnit test skeleton for node tree - firewire: core: add KUnit tests for successful tree building - firewire: core: add KUnit tests for failure of tree building - firewire: core: consolidate port counting in build_tree() - firewire: core: validate parent port count before allocating nodes in build_tree() - PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore - super: fix dying superblock warning messages - perf build: Remove leftover feature tests for removed cxx and clang support - kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix - selftests: harness: Restore order of test functions - selftests: harness: Mark test fixture objects __maybe_unused - selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM - spi: img-spfi: don't disable runtime PM on DMA deferred probe - PCI/ASPM: Disable/restore ASPM on every function for multi-function devices - power: supply: bd99954: Drop bad register fields - power: supply: bq27xxx: bq27520g4: fix REG_TTES address - power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address - power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address - xenbus: Unregister reboot notifier on init failure - clocksource/drivers/clps711x: Do not unmap clocksource MMIO - clocksource/drivers/armada: Unwind timer clock on init failure - ALSA: seq: midi: Optimize event_input locking with RCU - selftests/cgroup: Preserve CPU hotplug write errors - x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported - bpftool: Fix double close in map dump - ocfs2: fix circular locking dependency in ocfs2_init_acl() - selftests/bpf: Fix for veristat file/prog filters processing - scsi: ufs: core: Set task state before io_schedule_timeout() - bpf, arm64: Fix stack-passed arguments for indirect trampolines - tracing: Have trace_event_update_all() only handle module that is loading - HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU - selftests/bpf: Add tests to verify the fix of encapsulating VxLAN in lwt - selftests/bpf: Use ping_command() for IPv6 pings in lwt_ip_encap - ring-buffer: Remove trace_buffer::cpus - bpf: Fix pending_pos walk on 32-bit ring position wrap - selftests/sched_ext: Fix flaky ddsp failure tests on busy systems - crypto: hisilicon/sec2 - fix CCM algorithm long packet failure - crypto: lskcipher - propagate errors from unaligned crypt - sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry - perf dso: Guard against errno==0 when dso__get_filename() returns NULL - perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() - perf dso: Use stored fd error instead of stale errno in file_read() and file_size() - perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() - perf dso: Replace assert with runtime check in dso__read_symbol() - mailbox: rockchip: disable pclk on probe failure and unbind - mailbox: pcc: Fix command timeout due to missed interrupt - ublk: reject non-power-of-2 zone sizes in SET_PARAMS - hwmon: (emc1403) Drop hysteresis for low limit temperature - ksmbd: do not advertise unimplemented CA support - smb/server: preserve error status in smb2_handle_negotiate() - erofs: clean up encoded map flags - erofs: error out obviously illegal extents in advance - erofs: guard on-disk algorithm IDs against Z_EROFS_COMPRESSION_MAX - erofs: fix unused pcluster_pools for higher page sizes - ksmbd: disconnect on SMB3 decryption failure - nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper - nfs: refactor pNFS functions using clear_and_wake_up_bit - nfs: fix ENXIO on O_CREAT open of existing symlink over NFSv3 - clk: ti: mux: resolve parent clocks by DT index, not by name - octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap() - drm/xe: tests: fix error message in xe_migrate_sanity_test() - ptp: netc: skip PEROUT disable if channel is not enabled - ionic: fix completion descriptor access with 2x desc size - net: dsa: b53: fix error propagation from b53_fdb_dump() - pppox: drain queued packets on channel handoff - net: hsr: free learned nodes on device setup failure - f2fs:Fix incomplete search range in f2fs_get_victim when f2fs_need_rand_seg is enabled - f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk} - f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode - net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error - tls: fix RX desync on overlapping skbs - net: bridge: vlan: fix inverted default vlan notification - soc: qcom: ubwc: Fix missing include - ALSA: hda: Fix connection list comparison in proc output - vxlan: mdb: Fix use-after-free in vxlan_mdb_flush() - 8139cp: fix Rx and Tx not being disabled in cp_suspend - net/smc: hash socket only after full initialisation in smc_sk_init() - platform/x86: dell-wmi-sysman: Fix instance ID bounds - vsock: avoid timeout for non-blocking accept() with empty backlog - vsock: use sock_error() to consume sk_err after a failed connect - mlxbf-bootctl: fix the build error with FIELD_PREP() - bonding: initialize err for empty target lists - virtio_balloon: disable indirect descriptors - virtio: add virtio_device_shutdown() helper - virtio_balloon: factor out virtballoon_quiesce() - vhost/net: fix clear_user start address in VHOST_GET_FEATURES_ARRAY - virtio_pci: fix wrong queue index for admin vq in intx path - rtc: spacemit: handle regmap_test_bits() error return - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix - rtc: zynqmp: Return optional clock lookup errors - i2c: ocores: Disable clock on failed resume - rtc: gamecube: check return value of devm_rtc_register_device() - lib/interval_tree: fix allocation warning messages - prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator - clk: ti: Make sure clk_init_data is fully initialized - irqchip/gic-v5: Synchronize CPU interface disable - irqchip/gic-v5: Check for NULL LPI domain on domain teardown - irqchip/gic-v5: Fix gicv5_init_common() error paths - irqchip/gic-v5: Use logical cpu 0 irs_data for dynamic IST allocation - ALSA: core: Add scoped cleanup helper for card references - RDMA/ucma: Allow path records to exactly fit the output buffer - spi: amlogic-spisg: Make sure clk_init_data is fully initialized - smb: server: Remove obsolete "select CRYPTO_LIB_DES" from Kconfig file - smb: server: remove unused DES crypto header - irqchip/irq-realtek-rtl: Add/simplify register helpers - irqchip/irq-realtek-rtl: Add multicore support - irqchip/irq-realtek-rtl: Split out parent setup code - irqchip/irq-realtek-rtl: Add interrupt data structure - irqchip/irq-realtek-rtl: Add mask for interrupt handling - irqchip/irq-realtek-rtl: Use readl_be()/writel_be() instead of readl()/writel() - xsk: avoid double checking against rx queue being full - net/sched: add get_fill_size callbacks for actions missing them - net: thunderbolt: Count delivered packets in rx_packets and rx_bytes - net/mlx5: E-Switch, use state lock for vport state changes - net/mlx5: Move vport DOWN state check out of mlx5_query_vport_max_tx_speed() - net/mlx5: E-Switch, preserve max tx speed on vport state modification - forcedeth: stop the tx_timeout register dump past the requested window - net: ipa: balance runtime PM reference on remove error - net: add missing ref_tracker_dir_exit() to net_passive_dec() - ipmr: Move unregister_netdevice_many() out of mroute_clean_tables(). - ipmr: Move unregister_netdevice_many() out of ipmr_free_table(). - ipmr: Convert ipmr_net_exit_batch() to ->exit_rtnl(). - ipmr: Remove RTNL in ipmr_rules_init() and ipmr_net_init(). - net: change sock_queue_rcv_skb_reason() to return a drop_reason - ipmr: Free mr_table after RCU grace period. - ip6mr: plug drop_reason to ip6mr_cache_report() - net: tcp: block mixing readable and unreadable frags - rtc: pcf85363: Add error checking to regmap calls in probe() - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check - net: wangxun: replace busy-wait reset flag with kernel mutex - net: wangxun: schedule hardware stats update in watchdog - net: wangxun: introduce WX_STATE_DOWN to serialize device shutdown state - net: txgbe: fix MISC interrupt unmasking in non-MSI-X mode and device shutdown - net: libwx: fix concurrent bitmap overwrite in PTP setup - net: page_pool: Remove zone/policy GFP flags when allocating XArray entries - net_sched: sch_fq: fix pacing delay underflow with pacing offload - scsi: qla2xxx: Fix an loop timeout test - erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic - arm64: ptdump: Make note_page_flush() range aware - Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference - Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support - Bluetooth: btmtk: Do not report success when subsys reset fails - Bluetooth: btmtk: Do not discard the subsystem reset timeout - Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX - xsk: align TX metadata layout across ABIs - octeontx2-af: Fix TL3/TL2 link config ENA clearing - net: enetc: restore RX ring congestion mode after ring reconfiguration - net/sched: add qstats_cpu_drop_inc() helper - cifs: fix clearing stats for fastest execution of each smb2 command - selftests/mm: skip COW tmpfile cases when fallocate() is unsupported - maple_tree: catch race in mas_alloc_cyclic() - maple_tree: fix argument name in header - selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC - net: core: check skb_frags_readable before uncloning in skb_copy_ubufs - net/sched: sch_codel: clamp default mtu to avoid disabling CoDel - tpm: st33zp24: Validate locality read result - apparmor: policy_int make sure list heads are initialized before fail path - ceph: Fix ERR_PTR(0) in ceph_mkdir() - ceph: revalidate ki_pos for O_APPEND writes after cap acquisition - samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify - net: ethernet: sun4i-emac: Fix IRQ error handling - net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs - net: stmmac: selftests: Pass the IP proto mask in the TC selftest - drm/xe/xe_gt_idle: Add CCS to the powergating info print - netfilter: xt_HL: add pr_fmt and checkentry validation - netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() - selftests/arm64: Print missing MTE TAP headers - selftests/arm64: Treat KSM merge_across_nodes as optional - selftests/arm64: Fix MTE prctl TAP plan - net: airoha: npu: fix missing streaming DMA mask - net: stmmac: selftests: Check multiple MMC counters - net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering - net: stmmac: dwmac4: Account for the primary MAC address for UC filtering - net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering - net: stmmac: selftests: Account for the UC filter list for filtering tests - dm-integrity: fix buffer overflow with keyed discard - mtd: rawnand: pl353: Fix debug prints - platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL - serial: 8250: Ignore flow control on suspend/resume with no_console_suspend - usb: ucsi: huawei_gaokun: move typec_altmode off stack - cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks - cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset - cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name - cpufreq/amd-pstate: Grab "amd_pstate_driver_lock" when toggling dynamic_epp - cpufreq/amd-pstate: Add POWER_SUPPLY select for dynamic EPP - [Config] Make ACPI_PLATFORM_PROFILE built-in for amd64. - [Config] Add disable for X86_AMD_PSTATE_DYNAMIC_EPP - cpufreq/amd-pstate: Fix setting EPP in performance mode - wifi: nl80211: fix UHR capability validation - integrity: Eliminate weak definition of arch_get_secureboot() - [Config] Disable IMA_SECURE_AND_OR_TRUSTED boot for s390x - [Config] Enable new config HAVE_ARCH_GET_SECUREBOOT - block: save page offset gaps in cloned bio - erofs: relax sanity check for tail pclusters due to ztailpacking - erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check() - ipmr: Call ipmr_fib_lookup() under RCU. - ipmr: Add __rcu to netns_ipv4.mrt. - Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array - net/sched: fq: clamp quantum and initial_quantum in change path - cpufreq/amd-pstate: Add support for raw EPP writes - cpufreq/amd-pstate: Use "epp_default_dc" as default when dynamic_epp is disabled - cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified - ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init - ACPI: processor: idle: Move max_cstate update out of the loop - ACPI: processor: idle: Remove redundant static variable and rename cstate check function - drm/panel-edp: Add CSW PNB601LS1-2 and LGD LP116WHA-SPB1 - drm/gem: Consider GEM object reclaimable if shrinking fails - bus: fsl-mc: wait for the MC firmware to complete its boot - drm/xe/guc: Add support for NO_RESPONSE_BUSY in CTB - drm: rz-du: Ensure correct suspend/resume ordering with VSP - drm: renesas: rzg2l_mipi_dsi: Fix deassert/assert of CMN_RSTB signal - drm/amd/display: Fix DPMS using partially updated pipe context - drm/panel: jadard-jd9365da-h3: set prepare_prev_first - drm/amd/pm: Check SMUv13.0.6/12 metrics integrity - wifi: ath9k: Obtain system GPIOS from descriptors - gfs2: fix quota init duplicate scan - gpio: usbio: Add ACPI device-id for NVL platforms - gfs2: move quota_init qc iterator increment - drm/xe: Fix null pointer dereference in devcoredump cleanup - driver core: Replace dev->can_match with dev_can_match() - iio: adc: rtq6056: add i2c_device_id support - pinctrl: renesas: rzg2l: Handle RZ/V2H(P) IOLH configuration in PM cache - ALSA: usb-audio: Propagate write errors in generic mixer put callbacks - pinctrl: renesas: rzg2l: Add SR register cache for PM suspend/resume - ima: return error early if file xattr cannot be changed - usb: gadget: udc: skip pullup() if already connected - tee: optee: Allow MT_NORMAL_TAGGED shared memory - tools/nolibc: avoid call to wcslen() in _start_c() inserted by clang - PCI: Stop setting cached power state to 'unknown' on unbind - wifi: cfg80211: reject duplicate wiphy cipher suite entries - hfsplus: fix issue of direct writes beyond end-of-file - wifi: nl80211: reject beacons with bad HE operation - wifi: nl80211: check link is beaconing for color change - wifi: mac80211: always allow transmitting null-data on TXQs - wifi: mac80211: use chandef in ieee80211_get_sta_bw() - clk: clk-axi-clkgen: Add support versal timings - wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() - wifi: rtw89: suspend DIG when remain-on-channel - wifi: rtw89: disable HTC field in AP mode - wifi: rtw89: disable CSI STBC for VHT 160MHz - psp: validate IPv4 header fields in psp_dev_rcv() - i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 - ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit - kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() - firmware: stratix10-svc: change get provision data to async SMC call - bridge: Do not suppress ARP probes and DAD NS unconditionally - soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list - soundwire: validate DT compatible before parsing it - media: chips-media: wave5: Fix Reports from Kernel Lock Validator - media: chips-media: wave5: Release m2m_ctx after Instance Removed from List - dm-raid: only requeue bios when dm is suspending - spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM - media: rc: mceusb: Add support for 04eb:e033 - net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG - s390/cio: Purge based on the cdev's online status - media: platform: cros-ec: Add Kulnex and Moxoe to the match table - wifi: mac80211: avoid out-of-bounds access in monitor - thunderbolt: Avoid reserved fields in path config space for USB4 routers - thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible - thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() - thunderbolt: Keep XDomain reference during the lifetime of a service - thunderbolt: Keep the domain reference while processing hotplug - thunderbolt: Set tb->root_switch to NULL when domain is stopped - thunderbolt: Don't create multiple DMA tunnels on firmware connection manager - drm/amd/display: Find link encoder for flexible DIG mapping cases - drm/amdgpu: Prefer ROM BAR for default VGA device - drm/panel: Enable GPIOLIB for panels which uses functions from it - media: dm1105: fix missing error check for dma_alloc_coherent - net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family - PCI: switchtec: Add Gen6 Device IDs - net: dsa: mv88e6xxx: define .pot_clear() for 6321 - media: v4l2-common: Always register clock with device-specific name - net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family - media: em28xx-video: fix missing res_free() on init_usb_xfer failure - wifi: mac80211: explicitly disable FTM responder on AP stop - rtase: Fix flow control configuration - crypto: ixp4xx - fix buffer chain unwind on allocation failure - crypto: omap - add omap_des_unregister_algs helper - clk: renesas: cpg-mssr: Add number of clock cells check - drm/bridge: tc358768: Set pre_enable_prev_first for reverse order - dlm: add usercopy whitelist to dlm_cb cache - PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() - media: qcom: camss: avoid format string warning - net/mlx5: Relax capability check for eswitch query paths - drm/panel-edp: Add AUO B140XTN07.5, AUO B140HAK03.5, AUO B116XTN02.3, AUO B140XTK02.4, AUO B140HAN07.7 - drm/panel-edp: Add BOE NT140WHM-N4T, BOE NT140WHM-T05, BOE NV140FHM-N40 - phy: qcom: m31-eusb2: Make USB repeater optional - ASoC: ti: omap3pandora: update board check to use DT compatible - watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 - net/mlx5: HWS, Check if device is down while polling for completion - net/mlx5: HWS, Handle destroying table that has a miss table - platform/chrome: Resolve kb_wake_angle visibility race - drm/panel/tdo-tl070wsh30: Use refcounted allocation in place of devm_kzalloc() - mmc: core: Add validation for host-provided max_segs - genirq/proc: Size interrupt directory names for 10-digit interrupt numbers - serial: 8250_port: recognize UPIO_AU - mmc: davinci: avoid NULL deref of host->data in IRQ handler - platform/x86: sel3350-platform: Retain LED state on load and unload - drm/amd/display: Fix CRC open failure during active rendering - pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction - pinctrl: mediatek: common-v1: bypass pinctrl GPIO layer in set GPIO direction - drm/amd/ras: Fix CPER ring debugfs read overflow - hfsplus: rework hfsplus_readdir() logic - net: phy: motorcomm: use device properties for firmware tuning - drm/gud: Add RCade Display Adapter VID/PID pair - media: chips-media: wave5: Add range checks for dec_output_info - media: video-i2c: use vb2_video_unregister_device on driver removal - bus: mhi: host: pci_generic: Round up nr_irqs to power of two - drm/panel-edp: Add AUO B133HAN06.6 and BOE NV133FHM-N4F V8.0 - HID: multitouch: Fix Yoga Book 9 14IAH10 touchscreen misclassification - wifi: rtw89: phy: check length before parsing PHY status IE - net: dsa: realtek: rtl8365mb: add support for RTL8367SB - integrity: Check for NULL returned by asymmetric_key_public_key - drivers/of: validate live-tree string properties before string use - drivers/of: validate status properties in reconfig state changes - soundwire: intel: Move suspend tracking from trigger to pm suspend - clk: samsung: exynos850: mark APM I3C clocks as critical - scsi: pm8001: Reject firmware update in fatal error state - scsi: pm8001: Reject non-fatal dump when controller is crashed - crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y - crypto: atmel-ecc - add support for atecc608b - net: airoha: Reserve RX headroom to avoid skb reallocation - clk: qcom: clk-rpmh: Make all VRMs optional - media: imon: Add iMON VFD HID OEM v1.2 key mappings - RDMA/mlx5: Use QP port when decoding responder CQEs - coresight: perf: Retrieve path and source from event data - coresight: Disable source helpers in coresight_disable_path() - drm/mediatek: dsi: Add compatible for mt8167-dsi - iomap: don't make REQ_POLLED imply REQ_NOWAIT - mailbox: Make mbox_send_message() return error code when tx fails - drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction - PCI: Wait for device readiness after D3hot -> D0uninitialized transition - drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id - drm/amdkfd: Fix OOB memory exposure in get_wave_state() - drm/amdkfd: Check bounds on allocate_doorbell - ALSA: hda/ca0132: add QUIRK_GENERIC path for Gigabyte GA-Z170X-Gaming G1 - ALSA: ice1724: Fix blocking open for independent surround PCMs - ALSA: usx2y: Drain pending US-428 pipe-4 output commands - drm/amdgpu: use atomic operation to achieve lockless serialization - sched/fair: Reject misfit pulls onto busy SMT siblings on asym-capacity - iommu: arm-smmu-qcom: Ensure smmu is powered up in set_ttbr0_cfg - drm/imagination: Don't timeout job if its fence has been signaled - 9p: invalidate readdir buffer on seek - arm64: panic from init_IRQ if IRQ handler stacks cannot be allocated - arm64/daifflags: Make local_daif_*() helpers __always_inline - drm/imagination: Populate FW common context ID before passing to the FW - 9p: use kvzalloc for readdir buffer - drm/amd/ras: reset CPER ring on corrupt entry size - drm/amdgpu: cap ATOM command table nesting depth - drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw - drm/amdgpu: add first record offset check - drm/amdgpu: Bound GPIO I2C table entry count from VBIOS - drm/amdgpu: avoid integer overflow in VA range check - drm/amdgpu: check and drop invalid bad page records - bridge: Add missing READ_ONCE() annotations around FDB destination port - thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() - thunderbolt: Improve multi-display DisplayPort tunnel allocation - thunderbolt: Verify PCIe adapter in detect state before tunnel setup - firmware: arm_scmi: Validate SENSOR_UPDATE payload size - firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size - thunderbolt: Increase timeout for Configuration Ready bit - wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed - thunderbolt: Verify Router Ready bit is set after router enumeration - bitfield: wire __bf_shf to __builtin_ctzll - nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl - net: usb: qmi_wwan: add MeiG SRM813Q - net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() - net/sched: sch_drr: make cl->quantum lockless - net/rds: Don't sleep inside rds_ib_conn_path_shutdown - net/mlx5: Switch vport HCA cap helpers to kvzalloc - spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs - befs: handle set_blocksize failures - ntfs3: handle set_blocksize failures - affs: handle set_blocksize failures - bfs: handle set_blocksize failures - minix: handle set_blocksize failures - qnx4: handle set_blocksize failures - jfs: handle set_blocksize failures - hpfs: handle set_blocksize failures - omfs: handle set_blocksize failures - isofs: handle set_blocksize failures - HID: bpf: Add Huion Inspiroy Frego M button quirk - drm/panel-edp: Add LG LP129WT232166 panel - usbip: vhci_hcd: fix NULL deref in status_show_vhci - usb: core: hcd: fix possible deadlock in rh control transfers - usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log - USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set - usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue - serial: 8250: fix possible ISR soft lockup - usb: host: add ARCH_AIROHA in XHCI MTK dependency - tty: serial: 8250: protect against NULL uart->port.dev in register - driver core: Avoid warning when removing a device while its supplier is unbinding - crypto: atmel-sha204a - remove sysfs group before hwrng - char/nvram: Remove redundant nvram_mutex - gpib: Suppress setting END on error from NI_USB dongle - irqchip/gic-v5: Immediately exec priority drop following activate - pwm: mediatek: set mt7628 pwm45_fixup flag to false - rcu-tasks: Fix possible boot-time tests failed for the call_rcu_tasks() - virt: acrn: Fix irqfd use-after-free during eventfd shutdown - wifi: rtw89: pci: enable LTR based on pcie control register - netlabel: fix IPv6 unlabeled address add error handling - RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() - ALSA: seq: Remove arbitrary prioq insertion limit - rds: filter RDS_INFO_* getsockopt by caller's netns - rds: annotate data-race around rs_seen_congestion - s390/zcore: Removed unused variables - clk: socfpga: agilex: implement l3_main_free_clk - thermal/drivers/tegra/soctherma: Switch to devm cooling device registration - wifi: iwlwifi: fix the access to CNVR TOP registers - wifi: iwlwifi: mld: honor BSS_CHANGED_BEACON_ENABLED - wifi: iwlwifi: pcie: fix ACPI DSM check - wifi: iwlwifi: mld: call iwl_mld_free_ap_early_key() for AP only - wifi: iwlwifi: Transition to basic uAPSD with MAC_PM_POWER_TABLE API VER_3 - wifi: iwlwifi: pcie: add two LNL PCI IDs - wifi: iwlwifi: mld: disallow puncturing in US/CA for WH - wifi: iwlwifi: mld: purge async notifications upon nic error - wifi: iwlwifi: mld: keep healthy link on EMLSR missed beacon exit - powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked() - genirq/manage: Make NMI cleanup RT safe - drm/panel: simple: Add AM-1280800W8TZQW-T00H - mips: cps: Assemble jr.hb with an R2 ISA level - iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind - irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed - ALSA: usb-audio: Add quirk for Novation Mininova - net: hsr: require valid EOT supervision TLV - ipv6: addrconf: fix temp address generation after prefix deprecation - net: napi: Skip last poll when arming gro timer in busy poll - net: thunderx: fix PTP device ref leak in nicvf_probe() - ALSA: hda: cs35l41: imply SERIAL_MULTI_INSTANTIATE - drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device - drm/amd/pm/si: Fix updating clock limits from power states - drm/amd/display: Initialize dsc_caps to 0 - ACPICA: Fix condition check in acpi_ps_parse_loop() - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() - ACPICA: add boundary checks in acpi_ps_get_next_field() - ACPICA: validate byte_count in acpi_ps_get_next_package_length() - ACPICA: Prevent adding invalid references - ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) - ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() - ACPICA: validate handler object type in two places - ACPICA: Add package limit checks in parser functions - ACPICA: Add validation for node in acpi_ns_build_normalized_path() - ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() - ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() - ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() - ACPICA: add boundary checks in two places - hfs: rework hfsplus_readdir() logic - net: sfp: add quirk for OEM 2.5G optical modules - pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP - host1x: bus: Fix missing ops null check in error teardown - scripts: modpost: detect and report truncated buf_printf() output - drm/nouveau/gsp: add SEC2 to GA100 chip table - x86/topology: Add missing struct declaration and attribute dependency - ASoC: Intel: catpt: Complete coredump handling - drm/nouveau/bios: skip the IFR header if present - libbpf: Add __NR_bpf definition for LoongArch - soc/tegra: fuse: Register nvmem lookups at probe - soundwire: dmi-quirks: Disable ghost Realtek devices - gfs2: page poisoning fix - soundwire: only handle alert events when the peripheral is attached - mmc: davinci: fix mmc_add_host order in probe - ARM: tegra: tf600t: Invert accelerometer calibration matrix - mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC - ARM: tegra: p880: Lower CPU thermal limit - tracing: Disable KCOV instrumentation for trace_irqsoff.o - mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC - clk: samsung: exynos990: Fix PERIC0/1 USI clock types - media: qcom: camss: vfe-340: Proper client handling - iio: light: stk3310: Deal with the ps interrupt issue in PM - perf/ftrace: Fix WARNING in __unregister_ftrace_function - iio: accel: mma8452: switch to non-devm request_threaded_irq() - libbpf: Also reset {insn,data}_cur on realloc failure - spi: tegra210-quad: Allocate DMA memory for DMA engine - net: ibm: emac: Reserve VLAN header in MJS limit - wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi - ASoC: codecs: pcm3168a: Prevent regulator double-disable in S4 - ASoC: qcom: q6apm: return error code to consumers on failures - ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive - wifi: ath12k: Prevent incorrect vif chanctx switch when handling multi- radio contexts - ata: ahci: fail probe if BAR too small for claimed ports - ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge - ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach - ppc/fadump: invoke kmsg_dump in fadump panic path - net: qrtr: fix node refcount leak on ctrl packet alloc failure - net: wwan: t7xx: Add delay between MD and SAP suspend - net: txgbe: fix phylink leak on AML init failure - iommu/rockchip: disable fetch dte time limit - powerpc/fadump: Add timeout to RTAS busy-wait loops - fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib - nvme: refresh multipath head zoned limits from path limits - fs/ntfs3: validate index entry key bounds - ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() - ASoC: codecs: rk3328: Use managed GPIO and clock helpers - ALSA: seq: oss: Reject reads that cannot fit the next event - dpaa2-switch: rework FDB management on the bridge leave path - dpaa2-switch: fix the error path in dpaa2_switch_rx() - net: dsa: sja1105: flower: reject cross-chip redirect - dpaa2-switch: fix handling of NAPI on the remove path - wifi: rtw89: 8851bu: add Mercusys MA60XNB (2c4e:0128) - thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries - nvme: validate FDP configuration descriptor sizes - wifi: mac80211: clarify beacon parsing with MBSSID/EMA - wifi: mac80211: unify link STA removal in vif link removal - wifi: cfg80211: harden cfg80211_defragment_element() - wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect - wifi: iwlwifi: mvm: fix P2P-Device binding handling - wifi: iwlwifi: add support for AX231 - usb: xhci: Improve Soft Retries after short transfers - usb: xhci: remove legacy 'num_trbs_free' tracking - drm/amd/display: Avoid DPMS-on for phantom stream - xhci: Prevent queuing new commands if xhci is inaccessible - drm/amd/display: Check for sharpening case when calculating max vtaps for scaler - drm/amdkfd: fix UAF race in destroy_queue_cpsch - drm/amdgpu: harden FRU PIA parsing with bounded helpers - drm/amd/pm: bound pp_dpm_set_pp_table() memcpy - drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error - drm/amdgpu: fix buffer overflow during vBIOS update - drm/amdgpu: validate RAS EEPROM tbl_size before record count - net/mlx5e: Verify unique vhca_id count instead of range - RDMA/irdma: Fix typo in SQ completions generation - drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq - net/mlx5: E-Switch, align disable sequence with switchdev-to-legacy transition - net: ibm: emac: fix unchecked platform_get_irq return value - clk: keystone: don't cache clock rate - ALSA: hda/realtek: ALC882: Fixup for Clevo P775TM1 - ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP - perf/x86/intel/uncore: Guard against invalid box control address - ipmi: si: Use platform_get_irq_optional() to retrieve interrupt - cxl/region: Validate partition index before array access - x86/microcode/AMD: Move the no-revision fixup to get_patch_level() - net: ethtool: cmis_cdb: hold instance lock for ops locked devices - drm/amdkfd: fix SMI event cross-process information leak - drm/amdkfd: Unwind debug trap enable on copy_to_user failure - ipv6: use READ_ONCE() for bindv6only default in inet6_create() - wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications - RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() - RDMA/umem: Make ib_umem_is_contiguous() safe on 32 bit - firmware: stratix10-svc: fix FCS SMC call kernel-doc - RDMA/mlx5: Fix state and counter desync on loopback enable failure - bpf: NUL-terminate replaced sysctl value - net: cpsw_new: unregister devlink on port registration failure - hsr: broadcast netlink notifications in the device's net namespace - net: microchip: sparx5: clean up PSFP resources on flower setup failure - ALSA: es18xx: check control allocation before private data setup - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() - riscv: panic if IRQ handler stacks cannot be allocated - btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() - btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF - NFS: fix eof updates after NFSv4.2 fallocate/zero-range - ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() - RDMA/rtrs-srv: Fix integer underflow in process_read and process_write - xprtrdma: Add request-pool slack for delayed recycling - RDMA/mlx5: Create ODP EQ for non-pinned dmabuf MRs - configfs_depend_prep(): pass configfs_dirent instead of dentry - pds_core: quiesce DMA before freeing resources - net: ibm: emac: mal: fix potential system hang in mal_remove() - tls: Flush backlog before waiting for a new record - platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table - wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS - platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen - wifi: mt76: mt7925: add Netgear A8500 USB device ID - wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec - wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv - wifi: mt76: transform aspm_conf for pci_disable_link_state - netconsole: take target_cleanup_list_lock in drop_netconsole_target() - btrfs: protect sb_write_pointer() with invalidate lock - fbcon: don't suspend/resume when vc is graphics mode - PCI: Avoid FLR for MediaTek MT7925 WiFi - hwmon: (raspberrypi) Fix delayed-work teardown race - hwmon: (adt7462) Add of_match_table to support devicetree - btrfs: use on-disk uuid for s_uuid in temp_fsid mounts - btrfs: use lockless read in nr_cached_objects shrinker callback - net: dsa: qca8k: Add support for force mode for fixed link topology - net: lan966x: restore RX state on reload failure - vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add() - vdpa/octeon_ep: Use 4 bytes for mailbox signature - ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 - ata: libata-pmp: add JMicron JMS562 quirk - platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table - nvme-fc: Do not cancel requests in io target before it is initialized - sctp: Unwind address notifier registration on failure - HID: multitouch: Honor ContactCount for Yoga Book 9 to suppress ghost contacts - hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist - PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems - dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes - dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc - hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i - spi: xilinx: let transfers timeout in case of no IRQ - Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c - Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) - Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 - Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV - Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 - Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 - Bluetooth: btusb: Add support for TP-Link TL-UB250 - Bluetooth: L2CAP: validate connectionless PSM length - Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW - ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt - ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence - ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure - Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 - sparc64: uprobes: add missing break - net: stmmac: xgmac2: disable RBUE in default RX interrupt mask - ptp: ocp: add shutdown callback - vsock: use sk_acceptq_is_full() helper in all transports - e1000e: limit endianness conversion to boundary words - net: hns3: improve the unused_tuple parameter setting - net/sched: act_csum: don't mangle UDP tunnel GSO packets - smb: client: fix races in cifsd thread creation - i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA - bpftool: Pass host flags to bootstrap libbpf - sparc: Disable compat support with LLD - exfat: fix handling of damaged volume in exfat_create_upcase_table() - ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT - virtio-fs: avoid double-free on failed queue setup - HID: hidpp: fix potential UAF in hidpp_connect_event() - fuse: set ff->flock only on success - scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() - gpio: pisosr: Read "ngpios" as u32 - spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() - ALSA: usb-audio: Add quirk flags for SC13A - tls: reject the combination of TLS and sockmap - ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 - leds: uleds: Return -EFAULT on copy_to_user() failure - leds: pca9532: Don't stop blinking for non-zero brightness - mfd: tps65219: Make poweroff handler conditional on system-power- controller - leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE - mfd: rsmu: Add 8a34002 support - drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl - drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap - drm/amdgpu: Use system unbound workqueue for soft IH ring - ALSA: usb-audio: Add quirk for YAMAHA CDS3000 - drm/amdkfd: Properly acquire queue buffers in CRIU restore - PCI: iproc: Protect root bus removal with rescan lock - PCI: altera: Protect root bus removal with rescan lock - PCI: rockchip: Protect root bus removal with rescan lock - PCI: mediatek: Protect root bus removal with rescan lock - PCI: plda: Protect root bus removal with rescan lock - perf: Fix addr_filter_ranges lifetime - mailbox: imx: Use devm_pm_runtime_enable() - md/raid5: account discard IO - mailbox: imx: Add a channel shutdown field - mailbox: imx: use devm_of_platform_populate() - md/raid5: let stripe batch bm_seq comparison wrap-safe - ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 - f2fs: validate inline dentry name lengths before conversion - rtc: mv: add suspend/resume support for wakeup - rtc: aspeed: add AST2700 compatible - ksmbd: fix lease break and ack state handling - ksmbd: validate SMB2 lease create contexts - ksmbd: align SMB2 oplock break ack handling - ksmbd: use connection ClientGUID for lease lookup - ksmbd: treat unnamed DATA stream as base file - ksmbd: apply create security descriptor first - ksmbd: deny renaming directory with open children - ksmbd: start file id allocation at 1 - ksmbd: break RH leases before delete-on-close - ksmbd: treat read-control opens as stat opens only for leases - PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() - PCI/sysfs: Use kstrtobool() to parse the ROM attribute input - regulator: da9121: Use subvariant ids in the I2C table - net: au1000: move free_irq out of the close-time spinlocked section - blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat() - rtc: bq32000: add delay between RTC reads - eth: mlx5: fix macsec dependency - ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk - fbdev: pm2fb: unwind WC setup on probe failure - ASoC: tas2781: Update default register address to TAS2563 - spi: core: Abort active target transfer on controller suspend - btrfs: tree-checker: validate INODE_REF's namelen - drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend - netfilter: nf_conntrack_expect: zero at allocation time - ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr - ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED - drm/arm/komeda: fix error handling for clk_prepare_enable() and callers - ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr - ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling - xen/front-pgdir-shbuf: free grant reference head on errors - freevxfs: don't BUG() on unknown typed-extent type - xen/gntalloc: validate grant count before allocation - cachefiles: Fix double fput - netfs: Fix decision whether to disallow write-streaming due to fscache use - ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table - drm/amdgpu: flush pending RCU callbacks on module unload - ksmbd: fix credit charge calculation for SMB2 QUERY_INFO - ALSA: usb-audio: caiaq: validate EP1 reply lengths - wifi: ralink: RT2X00: init EEPROM properly - wifi: mac80211: validate deauth frame length before reason access - wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers - wifi: libertas: reject short monitor TX frames - wifi: cfg80211: validate assoc response length before status and IE access - ksmbd: find bound sessions during reauthentication - ksmbd: mark invalid session responses as signed - ksmbd: validate SID namespace before mapping IDs - wifi: cfg80211: validate rx/tx MLME callback frame lengths before access - wifi: mac80211: ibss: wait for in-flight TX on disconnect - gpio: dwapb: Mask interrupts at hardware initialization - wifi: libipw: fix key index receive bound checks - netfilter: ipset: mark the rcu locked areas properly - wifi: rsi: validate beacon length before fixed buffer copy - ASoC: rt712-sdca: reset codec at io_init to fix silent headphone - cifs: Fix support for creating SFU socket - smb/client: zero-initialize stack-allocated cifs_open_info_data - ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series - ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) - ALSA: hda: cs35l56: Fail if wmfw file is missing - cifs: Fix support for creating SFU fifo - btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr() - btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() - spi: dw-dma: Wait for controller idle before completing Tx - wifi: iwlwifi: mvm: validate sta_id in BA window status notif - btrfs: fix reloc root cleanup in merge_reloc_roots() - wifi: iwlwifi: mvm: validate mac_link_id in session protect notif - wifi: iwlwifi: mvm: fix an off-by-1 boundary check - wifi: iwlwifi: mvm: parse beacon notif per layout - wifi: iwlwifi: mvm: fix sched scan IE sizing - wifi: iwlwifi: pcie: null RX pointers after free - ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs - blk-cgroup: fix leaks and online flag on radix_tree_insert failure - smb/client: flush dirty data before punching a hole - ASoC: Intel: sof_sdw: Add quirks for new Dell laptops - wifi: iwlwifi: mvm: validate TX_CMD response layout - wifi: iwlwifi: mvm: fix a possible underflow - arm64: fixmap: Allow 256K early_ioremap() at any offset - wifi: iwlwifi: mvm: add a check on the tid coming from the firmware - wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif - arm64: kprobes: Allow reentering kprobes while single-stepping - drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized - ALSA: hda/realtek: Add quirk for HP Pavilion x360 - wifi: iwlwifi: bound aligned TLV advance in FW parser - ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless - wifi: iwlwifi: acpi: validate WGDS table revision index - ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE - wifi: mwifiex: replace one-element arrays with flexible array members - smb: client: bound dirent name against end of SMB response in cifs_filldir - regulator: core: clamp voltage constraints before applying apply_uV - wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO - ksmbd: preserve VFS inherited POSIX ACL mask - drm/gma500: return errors from Oaktrail HDMI I2C reads - phonet: check register_netdevice_notifier() error in phonet_device_init() - ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 - ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx - ice: pass the return value of skb_checksum_help() - powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash - cifs: validate idmap key payload length - wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame - ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) - ata: libata-core: Disable LPM on some WD drives - ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) - ata: libata-core: Disable LPM on WD Green 2.5 480GB - Drivers: hv: vmbus: add VTL2 redirect connection ID - ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx - vhost-scsi: flush backend after device ioctls - hwmon: (corsair-psu) Fix linear11 calculation - ata: libata-core: Disable LPM on WDC WD141KFGX-68FH9N0 - spi: dw: fix wrong RX_SAMPLE_DLY setting after resume - ASoC: rt5645: Perform the initial jack detect at probe - scsi: core: Do not block on tag allocation in scsi_eh_lock_door() - ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state - bpftool: Strip all -Wformat* flags from bootstrap libbpf build - ksmbd: remove stale channels from all sessions on teardown - iommu/arm-smmu-v3: Disable implementations during devm teardown - wifi: mt76: mt7921: validate CLC firmware records - wifi: mt76: mt7921: skip unknown CLC firmware records - leds: st1202: Validate pattern input before stopping the sequence - ppp_async: drop the errored frame instead of resetting its headroom - ARM: ensure interrupts are enabled in __do_user_fault() - RAS/AMD/ATL, EDAC/amd64: Only load ATL when needed - EDAC/igen6: Fix interleave boundary condition - EDAC/igen6: Fix channel selection hash - EDAC/igen6: Fix channel address decode for non-hash mode - EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation - drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() - drm/virtio: use the DMA API for resource backing on Xen - accel/qaic: Address potential out-of-bounds read in resp_worker() - nvme-rdma: fix -EIO cleanup order in queue_rq - nvmet-rdma: fix queue leak when connect backlog is exceeded - sched_ext: Fix nonexistent field in sched-ext.rst example - selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter - bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic - drm/gud: validate GUD_ROTATION_0 is present in supported rotations - accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain - ufs: do not treat unreadable directory blocks as empty - drm/cirrus-qemu: Validate BAR0 size during probe - net: icmp: avoid invalid transport header access in icmp_send tracepoint - tcp: use GFP_ATOMIC in tcp_send_active_reset() - net: iptunnel: fix stale transport header during tunnel decapsulation - net/sched: act_api: budget all shared attributes in notify skbs - net/sched: act_api: size the RTM_GETACTION reply from the actions - net/sched: act_api: fix skb sizing and action leak on reoffload delete - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START - scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() - scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() - smb/client: validate new EOF for insert range - smb/client: validate new EOF for zero range - smb/client: mark file sparse before emulating insert range - smb/client: fix data corruption in emulated insert range - smb/client: fix integer truncation in collapse range - smb: client: transport: Fix debug printing in __release_mid() - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration - raw: annotate disconnect-side IPv4 match writers - net: amd-xgbe: discard rx packets with bad FCS - vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() - watchdog: msc313e: Fix NULL pointer dereference in PM callbacks - perf symbol: Do not use debug file as the binary type - OPP: of: Fix potential multiplication overflow when calculating freq - perf powerpc-vpadtl: Fix raw_size of DTL samples - netfs: Fix unbuffered/DIO write partial transfer error return - netfs: Fix error vs transferred passed to ->ki_complete() - netfs: Fix i_size update for partial transfer - netfs: Fix subreq ref leak - netfs: break unbuffered write when netfs_alloc_subrequest() fails - cachefiles: Fix potential UAF/KASAN warning - ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF - ksmbd: propagate DACL parsing errors - ksmbd: rate limit unmapped SID errors - s390/time: Use jiffies instead of jiffies_64 - s390/ipl: Fix NULL deref in kdump without re-IPL parm block - s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block - s390/diag324: Preserve -EBUSY return code - sched_ext: Fix timer pinning and return value in scx_central - sched_ext: Update demo schedulers and selftests to use scx_bpf_task_set_dsq_vtime() - sched_ext: Fix vtime delta loss in scx_flatcg cgroup migration - Bluetooth: btintel_pcie: Clear automask on spurious interrupts - workqueue: reject watchdog thresholds that overflow jiffies - Bluetooth: btintel: validate version TLV value lengths - Bluetooth: btintel: bound firmware ID by TLV length - Bluetooth: hci_core: Fix race condition during device registration - Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan - Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect - Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM - Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() - ASoC: ab8500: Reset the audio block before configuring it - ASoC: ab8500: Repair the DAPM capture graph - ASoC: ab8500: Correct digital interface format setup - ASoC: ab8500: Validate and program TDM slots correctly - net: ethernet: oa_tc6: Interrupt is active low, level triggered. - net: ethernet: oa_tc6: Handle the OA TC6 SPI protected mode - net: ethernet: oa_tc6: Export standard defined registers - net: ethernet: oa_tc6: Add the OA_TC6_ prefix to standard registers - net: ethernet: oa_tc6: Protect skb pointer used by two different kernel instances - net: ethernet: oa_tc6: Improve the error recovery - net: ethernet: oa_tc6: Disable tx queues on fatal error - net: ethernet: oa_tc6: Fix for the wrong data type - net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted - igmp: convert struct ip_sf_list to RCU - ppp: ppp_async: simplify tty disc_data access - ppp: ppp_synctty: simplify tty disc_data access - ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() - ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() - ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit - tipc: fix NULL deref in tipc_named_node_up() on empty publication list - tipc: Dont send random pad bytes in RESET/ACTIVATE messages - ipv6: sr: restore network header before routing and forwarding - af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). - staging: fbtft: make dirty_lock IRQ-safe - ALSA: hda: restore MFG widget enumeration after core split - s390/boot: Fix physical memory search range - s390/boot: Avoid IPL parameter append past command line - ASoC: fsl_micfil: balance mclk enable/disable - ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits - ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() - drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl() - ALSA: dummy: Report a change when one capture switch channel moves - btrfs: detach failed sprout device from transaction update list - btrfs: restore active device pointers after failed sprout - bonding: alb: fix uninitialized transport header access in alb_determine_nd() - perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ - scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate - x86/itmt: Don't make ITMT enablement depend on debugfs - perf/core: Skip empty AUX records with only format flags - locking/lockdep: Invalidate stale class_cache entries for zapped classes - octeontx2-af: Fix limiting SRIOV VF count logic - ALSA: ump: do not touch legacy_rmidi before it exists - printk/nbcon: Change nbcon_irq_work to IRQ_WORK_LAZY - ASoC: ux500: Fix MSP stream lifecycle handling - ASoC: ux500: Propagate MSP setup errors - ASoC: ux500: Correct MSP frame and bit clock setup - ASoC: ux500: Validate MSP DAI configuration - mfd: db8500-prcmu: Fold dbx500 header into db8500 - ASoC: ux500: Deassert the MSP reset during probe - ASoC: ux500: Request the MSP MMIO resource - ASoC: ux500: Remove obsolete PRCMU QoS calls - ASoC: ux500: Allow repeated MSP prepare calls - ASoC: ux500: Program the MSP FIFO watermarks - btrfs: scrub: report the failing sector's address, not the stripe base - btrfs: fix transaction use-after-free in raid stripe insertion - btrfs: fix the possible bioc_list memory leak during error - btrfs: return proper negative error code for update_raid_extent_item() - btrfs: zoned: finish active block group cleanup if call_zone_finish() fails - btrfs: send: fix lost error return value in will_overwrite_ref() - btrfs: do not force reloc root creation during qgroup_account_snapshot() - btrfs: zstd: fix lost wakeup when waiting for a workspace - drm/amdgpu/userq: fix struct drm_amdgpu_info_device padding for 32bit compile - ipvs: fix reversed sequence option serialization - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() - tracing/probes: Fix use-after-free on field name/type of events with multiple probes - bpf: reject BPF_PSEUDO_FUNC reference to the main program - bonding: do not clear curr_active_slave prematurely when releasing all slaves - net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). - net/rds: use wq_has_sleeper() in release_in_xmit() - net/rds: use clear_bit_unlock() in release_refill() - net/rds: clear cp_flags bits individually in rds_conn_path_reset() - net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown - net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() - net/rds: acquire the fastpath locks in rds_conn_shutdown() - net/rds: don't let rds_conn_shutdown() consume a concurrent drop - net: airoha: enable RX_DONE interrupt for RX queue 31 - net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset - net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list() - arm64: trans_pgd: clone only the linear map that exists at runtime - erofs: disable LZ4 rolling decompression for now - selftests/alsa: Fix the step check for INTEGER controls - ALSA: caiaq: Fix potential double-free at error path - drm/rockchip: dw_dp: Select DRM_BRIDGE_CONNECTOR - drm/rockchip: rk3066_hdmi: Add missing Kconfig selects - bpf: Fix NULL-ptr-deref when showing a void BTF type - bpf: Fix NULL-ptr-deref in btf_var_show() - bpf: Mark signal tracepoint siginfo arguments as scalar - bpf: Reject tail calls directly from callback frames - bpf: Reject resilient lock operations in rbtree callbacks - bpf: Mark sched_process_wait argument as nullable - nvme: remove stale namespaces by NSID range during scan - nvme-tcp: defer TLS inline send to io_work - ASoC: Intel: avs: Clean up the bus when fetching ML caps fails - ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology - ASoC: Intel: avs: Fix unbalanced module reference count - ASoC: Intel: avs: Refactor and fix init_config access - net: bcmasp: clear txcb->last before writing each descriptor - net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times - mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context - bpf: Only enforce 8 frame call stack limit for all-static stacks - bpf: share several utility functions as internal API - bpf: Print breakdown of insns processed by subprogs - bpf: Report maximum combined stack depth - bpf: Track verifier instruction stats for each subprogram - bpf: Check ancestor frames for rbtree callbacks - bpf: Mark bpf_btf_find_by_name_kind() as sleepable - bpf: Mark faultable stack helpers as sleepable - bpf: Reject legacy packet loads from callbacks - bpf: Don't predict JMP32 pointer vs zero comparisons - thermal: sysfs: switch to use scnprintf() to suppress truncation warning - bpf: Require MEM_PERCPU for percpu kptr stores - bpf: Reject untrusted allocated-object pointers - tracing: Fix to avoid creating trace instances with duplicate names - selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0 - nexthop: Initialize extack in remove_nh_grp_entry() - bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit() - net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size - eth: nfp: bound the ntuple rule dump by the caller's buffer size - eth: nfp: drop the replaced rule from the list when reprogramming fails - net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size - net: bridge: mcast: properly convert mglist to rcu - octeontx2-af: mcs: Clear stale X2P calibration state before calibration - ionic: use netif_txq_maybe_stop() in ionic_tx() - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow - dibs: change dibs_class to a const struct - dibs: Unregister dibs_class after error - s390/ism: folio_put() after error - vxlan: reject dynamic fdb entries that reference a nexthop id - net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations - net: reject oversized tx_queue_len at netlink parse time - pds_core: fix cmd_regs access racing BAR unmap on reset - pds_core: don't release PCI regions for VFs on reset - powerpc/kexec_file: Use inclusive range checks in add_usable_mem() - powerpc/kexec_file: Use inclusive range checks for excluded memory - net: mctp: i3c: serialize probe with bus removal - net/sched: defer qdisc freeing after failed creation - net/mlx5e: Fix missing FEC mode mapping for RS_544_514_INTERLEAVED_QUAD - net/mlx5e: Fix setting RS FEC after remapping - net/mlx5: LAG, use local tracker to update active ports - net/mlx5e: Fix ETS zero BW reporting when one TC holds 100% - net/mlx5e: Fix use-after-free race in sample_restore_put() - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put - net/mlx5: E-Switch, prevent mc_list repopulation during vport disable - net/mlx5e: Keep HW timestamp stats monotonic across reconfiguration - net/sched: fq_pie: clamp quantum in change path - net/sched: sfq: clamp quantum in change path - net/sched: hhf: clamp quantum in change and init paths - net/sched: dualpi2: clamp psched_mtu at all call sites - net/sched: pie: clamp psched_mtu in pie_drop_early - net/sched: drr: clamp quantum in change class - net/sched: ets: clamp quantum in parse and fallback paths - net: macb: fix NULL pointer dereference on unbind with fixed-link - bpf: Reject non-scalar bpf_loop iteration counts - ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev - iommu/riscv: Add command queue lock - iommu/riscv: Disable SADE - iommu/amd: Add NUMA node affinity for IOMMU log buffers - iommu/amd: Do not reallocate GA log buffers on resume - iommu/amd: Fix premature break in init_iommu_one() again - hwmon: (ltc4282) Make sure clk_init_data is fully initialized - Documentation/hwmon: Document hwmon_notify_event() - hwmon: Fix potential UAF in pec_store - hwmon: (ina2xx) Acquire hwmon_lock in shunt_resistor_show() - hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() - hwmon: (ina2xx) Replace masks with enum in alert functions - hwmon: (ina2xx) Decouple in0 and curr1 alarms - Documentation: hwmon: replace full-width colon by a standard ASCII colon - hwmon: (sht4x) Fix return value from heater_enable_store() - ASoC: bcm: bcm63xx: Publish the OF module aliases - ASoC: Intel: SST: Publish the PCI module aliases - netfilter: nfnetlink_log: cope with concurrent instance destruction - netfilter: ip6_tables: set F_PROTO when proto value is nonzero - ASoC: mt6351: Publish the OF module alias - irqchip/gic-v5: Preserve ICC_CR0_EL1 state - virtio: fix use-after-free in unregister_virtio_device() - virtio_console: do not free control-out buffers on remove - vhost/vdpa: reject VRING_NUM larger than device max - vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx - vhost-vdpa: protect config_ctx from being freed under the config callback - vdpa_sim_blk: reject out-of-range sector starts - vdpa_sim_net: check TX pull result before RX copy - virtio-pci: return IRQ_HANDLED after non-zero ISR - virtio_input: reset device if input_register_device() fails - virtio_input: stop callbacks before unregistering input device - af_unix: Update last skb marker in manage_oob(). - af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer. - net: ipv4: Fix UDP length overflow with PMTU discover and big MTU - net: ipv6: Fix UDP length overflow with PMTU discover and big MTU - net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward - net: ethernet: cortina: Fix budget accounting - net: ethernet: cortina: Finish RX updates before NAPI completion - net: ethernet: cortina: Count dropped frames as NAPI work - net: ethernet: cortina: No mapping is a dropped rx - net: ethernet: cortina: Count RX drops once per frame - net: ethernet: cortina: Count RX descriptors for freeq refill - drm/adp: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER - drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER - ALSA: hda: Report a change when only the channel status bytes move - idpf: account for VLAN header when parsing RSC packet header - ice: add missing xa_destroy for sched_node_ids - eth: ice: don't dereference pointers from TP_printk() - Bluetooth: btusb: Fix UAF of btusb_data by rx_work - Bluetooth: btintel_pcie: validate packet_len before skb_put_data - Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one - Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() - Bluetooth: btusb: mediatek: Fix leaked runtime PM reference in reset - Bluetooth: btusb: Fix leaked runtime PM reference in btusb_reset - net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() - ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings() - net: macb: destroy the phylink instance on the probe error path - net: macb: put the "mdio" child node reference on success - mptcp: remove unneeded READ_ONCE() annotation - watchdog: fix hrtimer start when pretimeout is zero - watchdog: msc313e: Avoid division by zero - watchdog: msc313e: Fix clock leak and spurious timer in settimeout() - watchdog: msc313e: Enable clock before accessing hardware registers - watchdog: msc313e: Fix spurious reset on suspend - watchdog: msc313e: Fix undefined behavior - watchdog: msc313e: Sync timeout value if WDT was running at boot - net: dsa: lantiq_gswip: fix GSWIP_MDIO_PHY_FCONTX_EN value - net: ks8851: Fix receiver error in 100BASE-TX mode following software power-down - hwmon: (corsair-cpro) Create debugfs entries after hwmon registration - hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() - hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors - hwmon: (corsair-cpro) Remove debugfs entries when probe fails - hwmon: (nct6694) do not expose enable on DTIN temperature channels - octeontx2-pf: reset HTB scheduler topology before freeing queues - vxlan: initialize _md in vxlan_xmit_one() - ppp_synctty: ensure a writeable skb header - net: stmmac: initialize ptp_lock at probe time - devlink: Refactor resource functions to be generic - devlink: Add port-level resource registration infrastructure - net/mlx5: Register SF resource on PF port representor - net/mlx5e: Move representor vnic reporter to eswitch devlink port - selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value - perf/core: Allow list_del during perf_event_overflow() - perf/x86/intel: Correct pt_regs->flags update for PEBS path - perf/x86/intel: Prevent drain_pebs() reentry - sched/eevdf: Fix augmented max_slice - sched/eevdf: Fix rb augmented with multi fields - sched: Account cgroup CPU time to the execution context - sched/core: Call wq_worker_tick() for the execution context - net/sched: cls_route: free emptied bucket on filter move - net/sched: cls_route: Reject handle aliasing - net/sched: cls_route: Fix in-place replace - net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). - net: sun4i-emac: fix missing of_node_put() for phy_node - net: hinic: fix mailbox segment buffer overflow - net: dsa: mt7530: add EN7528 support - net: dsa: mt7530: populate lpi_interfaces to fix EEE support - net: ethernet: mtk_eth_soc: avoid writing to ESW registers on MT7628 - net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support - net: phy: mediatek-ge: disable EEE on the MT7530 PHY - net: net_failover: Fix the deadlock in net_failover_slave_name_change() - octeontx2-af: fix PF/CGX debugfs PCI bus lookup - net: phy: dp83867: handle the active-high LED polarity mode - net: mana: restore the XDP program pointer when pre-allocation fails - net/rds: fix tcp stream corruption with large pages - net: stmmac: fix TSO support when some channels have TBS available - net: stmmac: add stmmac_tso_header_size() - net: stmmac: add TSO check for header length - net: stmmac: fix TX descriptor availability check for TSO traffic - net: hsr: enable promiscuous mode on interlink port with fwd offload - openvswitch: fix wrong flag value in get_ipv6_ext_hdrs() - sunvdc: unmap LDC cookies when the descriptor send fails - erofs: add missing buf->off in erofs_bread() - scripts/mksysmap: drop the MODULE_INFO() symbols from kallsyms - scripts/mksysmap: fix escape of '$' in the __pi_ pattern - scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands - configfs: pin the symlink target's dirent instead of chasing ->ci_dentry - powerpc/ps3: Fix repository.c build failure - powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver - powerpc: pci-ioda: Fix the stale irq chip reference - x86/amd_node: Avoid divide by zero on virtualized systems - x86/amd_node: Fix potential NULL pointer dereference - crypto: x86/aria - add missing vzeroupper in AVX2 code - crypto: x86/aria - add missing vzeroupper in AVX-512 code - x86/amd_node: Fix PCI device reference counting in amd_smn_init() - x86/mm: Fix user-space data loss with MADV_FREE and THP - x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash() - x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF - x86/alternatives: Exclude text poking against change_page_attr() - ipv6: fix fib6 walker UAF on seq stop - reboot: fix cad_pid use-after-free race - tracing: Fix memory corruption from the histogram stacktrace modifier - tracing: Restore :mod: trailer after parsing in ftrace_set_clr_event() - tracing: Fix memory corruption from a "STACKTRACE" histogram key - rust: allow `clippy::as_underscore` in the generated bindings - rust: allow `unknown_lints` in generated bindings for Rust < 1.88 - drm/panic: clean new `clippy::needless_range_loop` lint for Rust 1.100.0 - ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough - ALSA: us122l: Prevent write upgrades for read mappings - ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf - ALSA: usbusx2y: validate URB actual_length in interrupt callback - Revert "riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set" - dm/amdgpu: fix malformed link_settings debugfs output - drm/amdgpu: skip gfx switch_power_profile during GPU reset - watchdog: sunxi_wdt: preserve boot-enabled watchdog - virtio_mmio: disable IRQ wake before free_irq - ufs: create the root dentry after loading cylinder metadata - ufs: validate cylinder group metadata before caching it - tunnels: Drop stale dst when building an ICMP error for PMTUD - tick/broadcast: Plug clockevents replacement race - tools/bootconfig: Fix integer overflow and truncation in size checks - tracing/user_events: Don't destroy fields when event removal fails - tracing: Free histogram the var ref when its initialization fails - tracing: Free histogram var refs regardless of how often they are referenced - tracing: Free histogram the field rejected for a bad modifier - tracing: Let histogram values keep the percent and graph modifiers - tracing: Keep the entry count when the histogram stats allocation fails - accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr - accel/ivpu: Validate firmware log buffer metadata - accel/ivpu: Limit firmware log name prints to field size - ASoC: sprd: validate compress buffer sizes against fixed allocations - ASoC: sti: initialize IRQ lock before requesting IRQ - Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev - Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 - cpufreq: zero-initialize policy cpumask before sysfs publication - cpufreq: initialize policy rwsem before sysfs publication - exec: do_close_on_exec() before taking exec_update_lock - fs: don't return -EINVAL for successful nested thaw - function_graph: Use the saved entry's size when reprinting it - drm/bridge: tc358768: Enforce input bus flags via atomic_check - drm/drm_exec: fix up contended obj when num_objects is 0 - drm/i915: Fix memory leak in query_perf_config_list() - drm/rockchip: analogix_dp: fix unchecked bound endpoint name length - drm/sched: Create a fake device for KUnit tests - io_uring/net: let io_recv_buf_select return the length of the buffer region - io_uring/net: don't overconsume buffers when using MSG_TRUNC - ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters() - ring-buffer: Check resize_disabled before publishing the new subbuf order - net/sched: act_api: release all action references on NEWACTION failure - net: bridge: use option bits for CFM/MRP frame handlers - net: dsa: tag_brcm: legacy FCS: request needed tailroom - net: hso: fix TIOCMIWAIT race - net: mana: Reserve extra CQ slot for the fence completion CQE - net: mpls: clear inner_protocol when the last label is popped - net: openvswitch: fix use-after-free of the flow table mask array - net: phy: dp83td510: handle the active-high LED polarity mode - netfs: Fix uninitialized return value in netfs_unbuffered_write() - netfilter: nf_log: unregister loggers before per-net teardown - netfilter: report NLM_F_DUMP_FILTERED when all is filtered out - vdpa: ifcvf: Put device on unsupported feature error - vdpa: solidrun: Free IRQs after request failure - scripts/sorttable: Mark long_size as __maybe_unused - fs: autofs: fix memory leak in autofs_fill_super() - erofs: preserve LZMA decoders on resize failure - fbdev: vfb: defer cleanup until the last reference - inet: frags: invalidate queues before flushing them - ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink - ieee802154: cc2520: fix FIFOP work use-after-free - ieee802154: hwsim: serialize pib updates to fix double-free - ipv4: fib: bound automatic table ID allocation - ipv6: flowlabel: cap duplicate leases per socket - ipvs: reject invalid states in connection template sync records - mac802154: fix use-after-free of sdata via queued RX frames - KVM: PPC: Book3S HV: Set irqfd->producer only on success - iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX - s390/qeth: allow bridgeport queries despite OS_MISMATCH - s390/crypto: Fix skcipher_walk return code handling in aes_s390 - s390/crypto: Fix use of mutex in atomic context - s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm - s390/crypto: Fix missing cra_flags in paes_s390 - s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine - s390/crypto: Fix missing scrub of temp buffers with PAES algorithm - s390/crypto: Fix wrong return code to engine in asynch callbacks - s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly - perf: RISC-V: store available counter mask as bitmap - perf: RISC-V: use BIT_ULL for u64 overflow masks - afs: Fix missing kunmap in afs_dir_search_bucket() - afs: Fix double-unmap of directory block - afs: Fix incorrect free in candidate cleanup in afs_lookup_server() - afs: Clear stale peer app data after address list changes - hwmon: (applesmc) fix key backlight workqueue leak on register failure - hwmon: (chipcap2) fix channels in humidity alarm notifications - hwmon: (gpio-fan) Fix use-after-free in alarm work - hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS - media: hevc: add bounded tile-count helpers - media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity - media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity - media: v4l2-h264: Fix memcmp() size in B1 reference list comparison - media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer - media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity - media: v4l2-ctrls: validate HEVC tile counts - media: v4l2-ctrls: validate AV1 tile counts - bnxt_en: Only restore LRO if the device supports TPA - bnxt_en: Don't free the live ring's TPA state on queue restart failure - bnxt_en: Propagate RX ring init failures in bnxt_init_nic() - bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() - mptcp: options: handle MPC data + csum reqd + no csum - mptcp: subflow: no need to copy thmac during ulp_clone - mptcp: syncookies: remember the request backup flag - selftests: mptcp: fix an UAF in mptcp_connect.c - mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 - mptcp: pm: userspace: fix address ID overflow - smb: client: reject userspace cifs.idmap descriptions - smb: client: reject short READ responses in CIFSSMBRead() - smb: client: pin DFS superblock in iterator callback - smb: client: fix one-byte OOB read in smb2_parse_native_symlink() - smb: client: fix file type corruption in cifs_reparse_point_to_fattr() - smb: client: fix file type corruption in posix_reparse_to_fattr() - smb: client: fix file type corruption in wsl_to_fattr() - smb: client: avoid leaking refcount in cifs_queue_oplock_break() - smb: client: avoid leaking refcount when cifs_sb_tlink() fails - smb: client: fix heap overflow in DACL owner/group rewrite - xfs: use the rtgroup extent count to find rtrefcount gaps - xfs: truncate quota file correctly when repairing quota file - xfs: strengthen the "is cow staging" helpers in scrub - xfs: snapshot scrub stats when rendering them - xfs: snapshot old AGFL before rewriting it - xfs: signal inode btree xref error if get_rec returns an error - xfs: reset parent pointer args before each dir tree unlink repair - xfs: report nonexistent parents as a filesystem corruption - xfs: report healthy filesystem events in scrub stats - xfs: release alleged child inode on metapath unlink error - xfs: preserve owner on in-memory btree creation - xfs: make the rtsummary repair fix the file size too - xfs: log the tempip after we convert it to extents format - xfs: initialise error in xfs_defer_finish_one() - xfs: fix xfs_rtrmapbt_mem_cursor for non-rmap filesystems - xfs: fix unit conversions in per_binval computation - xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions - xfs: fix short ifork reaping computation in xreap_bmapi_binval - xfs: fix rtrmap cross-referencing elision logic - xfs: fix rtrefcount btree block counting in scrub - xfs: fix replaying dirent removals into the temporary directory - xfs: fix reclaimed page accounting in xfs_buf_free - xfs: fix parent rec lookup initialization in xrep_metapath_unlink - xfs: fix name string recording in slowpath pptr tracepoints - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN - xfs: fix bnobt repair space reservation disposal failure - xfs: fix backwards skipping logic in xrep_quota_block - xfs: fix backwards mergeability logic in refcount scrubber - xfs: don't spin forever on zero-length dirents when salvaging them - xfs: don't modify file attributes or poke fsnotify for dry runs - xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails - xfs: don't leak dqacct if rhashtable insertion fails - xfs: destroy seen inode bitmap when we fail to add a dirpath - xfs: cross-reference the rtgroup superblock extent, not block - xfs: count escaped corruption errors in scrub stats - xfs: compute dquot checksum after resetting dd_lsn in repair - xfs: bail out on bitmap errors in xrep_agfl_fill - xfs: advance the findparent inode scan cursor while holding ILOCK - xfs: actually recover intended file sizes in xfs_xmi_item_recover_intent - xfs: actually check internal-rtdev fields in the superblock - hwmon: (sht4x) Add missing locks - ksmbd: don't hold ci->m_lock while waiting for a lease break ack - crypto: ccp - Fix possible deadlock in SEV init failure path - usb: xusbatm: don't rely on id table pointer arithmetic - wifi: ath9k_htc: don't store usb_device_id - usb: usbtmc: don't store usb_device_id - usb: serial: spcp8x5: don't store usb_device_id - media: as102: do not rely on id table address comparison - net: usb: pegasus: don't rely on id table pointer arithmetic - i2c: smbus: reject oversized block transfers in the common path - net: appletalk: fix NULL pointer dereference in aarp_send_ddp() - media: remove conditional return with no effect - media: qcom: iris: fix runtime PM reference leaks - scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path - scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking - scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown - scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size - scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate - scsi: qla2xxx: Skip vport under deletion in report ID acquisition - scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs - scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot - scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature - scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity - scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error - scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock - scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] - f2fs: accurately adjust free_sections during free_segment_range - Revert: "f2fs: check in-memory block bitmap" - drm/amdgpu: add a helper to calculate ring distance - drm/amdgpu: reorder IB schedule sequence - drm/amdgpu: Make amdgpu_vm_flush() non-failing in submission path - drm/amdgpu: plumb timedout fence through to force completion - i2c: designware: Global register definitions - drm/pagemap: dma-unmap pages before handling migration errors - ipmr: account multicast table and route memory - x86/mm/pat: Convert split_large_page() to use ptdescs - x86/mm/pat: Don't gate cpa_lock on debug_pagealloc_enabled() - x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF - x86/mm/pat: Allocate split page tables as kernel page tables - bootconfig: Fix integer overflow in initrd size check - genetlink: pin family module during policy dump - io_uring/rw: end write accounting from ->ki_complete - drm/amd/display: Rebuild InfoFrames on output color space changes - drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches - drm/amd/display: Propagate HDMI RGB quantization selectability - drm/amd/display: Honor Broadcast RGB for BT.2020 RGB output - drm/bridge: ti-sn65dsi83: Fix error handling in sn65dsi83_reset_work() - xfs: initialise args->total for parent pointer updates - tracing: Set the trace clock before registering the histogram trigger - tracing: Take the reference before publishing the named histogram trigger - tracing: Undo the registration when enabling the histogram trigger fails - EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout - EDAC/altera: Use parent device for devres in altr_portb_setup() - netfilter: cttimeout: prevent UAF during module unload - exit: hold a reference to thread_pid across proc_flush_pid - net: macb: Replace open-coded implementation with napi_schedule() - net: macb: Use netif_napi_add_tx() instead of netif_napi_add() for TX NAPI - net: macb: unify device pointer naming convention - net: macb: initialize PTP state before registering clock - erofs: add sysfs feature entry for xattr prefixes - idpf: disable DIM work before freeing q_vectors - landlock: Use mem_is_zero() in is_layer_masks_allowed() - landlock: Fix use-after-free of the source's parent directory - mptcp: pm: reset retrans_time when ADD_ADDR entry is reused - bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() - mptcp: do not reschedule the RTX timer for fallback sockets - mptcp: prevent race between disconnect() and rtx - smb: client: refactor ACL setting control flow in id_mode_to_cifs_acl() - smb/client: fix security flag calculation when setting security descriptors - smb: client: fail DACL rewrite when the new DACL exceeds 64K - misc: amd-sbi: Add null check for devm_kasprintf() - x86/mm: Fix and document DEBUG_PAGEALLOC - mptcp: move the stale logic out of retrans scheduler - mptcp: avoid unneeded actions on subflow reset - mptcp: close race between scheduler and state change - mptcp: fix bad accounting in __mptcp_subflow_push_pending() - btrfs: abort transaction before releasing tree_log_mutex on commit failure - ksmbd: fix maximum allowed access checks - smb/server: fix tree connection leak in smb2_tree_connect() - drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader - drm/connector: Introduce drm_output_color_format enum - drm/display: hdmi: Use drm_output_color_format instead of hdmi_colorspace - drm/display: hdmi-state-helper: Try subsampling in mode_valid - cgroup/cpuset: Avoid unnecessary cpus & mems update in cpuset_hotplug_update_tasks() - ARM: imx: avic: Fix OF node reference leaks - ARM: OMAP2+: Fix OF node reference leaks in omap_hwmod - firmware: imx: sm-misc: Add NULL check for kmalloc in syslog_show - sched/core: Fix inter-class wakeup_preempt() - perf/x86/intel/uncore: Fix PCI PMU cleanup on setup failure - perf/x86/intel/uncore: Fix refcnt and other cleanups - perf/x86/intel/uncore: Let init_box() callback report failures - perf/x86/intel/uncore: Factor out box setup code - perf/x86/intel/uncore: Introduce PMU flags and broken state - perf/x86/intel: Keep cap_user_rdpmc in sync with RDPMC user-disable state - drm/panthor: Split panthor_vm_prepare_map_op_ctx() to prepare for reclaim - drm/panthor: Pass vm_bind_op to vm_prepare_map_op_ctx - workqueue: only show running workers in stall diagnostics - wifi: ath12k: fix TLV32 length mask - perf util: Sort includes and add missed explicit dependencies - perf evlist: Add reference count - perf evsel: Add reference count - perf evlist: Add reference count checking - perf parse-events: Restrict core PMU bypass to --cputype option - perf tests: Fix Python JIT dump profiling test failure - wifi: rtw89: fw: correct preload field of w2 in rtw89_fw_h2c_default_cmac_tbl_be() - wifi: rtw89: fw: fix link ID filling for LPS MLO common info - uprobes/x86: Remove struct uprobe_trampoline object - uprobes/x86: Do not leak trampoline vma mapping on optimization failure - uprobes/x86: Allow to copy uprobe trampolines on fork - perf cs-etm: Filter synthesized branch samples - libbpf: Add uprobe syscall feature detection - libbpf: Add support to detect nop,nop5 instructions combo for usdt probe - libbpf: Change has_nop_combo to work on top of nop10 - perf test amd ibs: avoid using executable heap - perf vendor events amd: Update Zen 6 core events - hwrng: omap - Fix probe error path cleanup - fuse: move "epoch" from dentry.d_time to fuse_dentry.epoch - arm64: dts: qcom: monaco: fix wrong connection for the replicator - arm64: dts: qcom: sc8280xp: sort reserved memory regions - PCI: qcom: Skip PERST# GPIOs provided by downstream PCIe devices - perf record: fix poll storm when monitored threads exit - bpf: Introduce jit_required flag and remove bpf_prog_has_kfunc_call() - arm64: dts: mediatek: tungsten-smarc: Remove unnecessary cells - remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 - usb: typec: tcpm: fix EPR AVS APDO maximum voltage decoding - usb: chipidea: imx: fix missing ret assignment for dev_err_probe - perf record: Fix teardown hang on system-wide multi-threaded sessions - clk: spacemit: k3: fix parent clock of UFS aclk - tools/sched_ext: scx_flatcg: Fix uninitialized stats on allocation failure - arm64: dts: renesas: rzt2h-n2h-evk: Remove unused MII/GMII pins - wifi: ath12k: fix MLO peer delete race - wifi: ath12k: fix rx_mpdu_start layout for QCC2072 - firmware: arm_scmi: Clear SystemPower flag on create failure - firmware: arm_scmi: Fix OF node reference handling - PCI: keystone: Fix OF node reference leak in init - media: ti: vpe: Select V4L2_FWNODE for VIP - drm/amd/display: remove duplicate link_dp_panel_replay.h include - arm64: dts: qcom: milos: Add reset for sdhc_2 - perf sched: Add missing perf_session__delete() - perf sched: Fix memory leaks in perf sched stats report - perf sched: Free subcommand string after perf sched stats - drm/solomon: remove unneeded variables in blit functions - perf stat: Fix duplicate output with --for-each-cgroup - gpu: host1x: Avoid double device_add when clients already present - drm/msm/a6xx: Fix IRQ storm during msm_recovery test - bpf: Sync tail_call_reachable with callee state on entry - crypto: aspeed - Propagate platform_get_irq() errors - tlclk: if sscanf() fails, fall back to 0, not random value - gpib: use 'static inline' instead of 'extern inline' - vfio: selftests: Add helper to set/override a vf_token - vfio: selftests: Avoid VLAs - soc: ti: knav_qmss_queue: Implement resource cleanup in remove() - soc: ti: knav_qmss: Remove debugfs file on teardown - drm/v3d: Drop unused drm_encoder.h include from v3d_drv.h - drm/v3d: Extract v3d_job_add_syncobjs() helper - drm/v3d: Migrate BO reservation locking to DRM exec - drm/v3d: Introduce struct v3d_submit and convert CL/TFU/CSD ioctls - drm/v3d: Make v3d_get_cpu_indirect_csd_params() a pure parser - drm/v3d: Convert submit helpers to operate on struct v3d_submit - bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn - samples: rust: debugfs: fix excessive stack use - selftests/bpf: Fix make install target - wifi: ath12k: advertise ieee_link_id in vdev start MLO params - wifi: ath12k: fix ML-STA authentication timeout on QCC2072 - wifi: ath12k: fix survey indexing across bands - riscv: dts: spacemit: set console baud rate on K3 Pico-ITX board - gpu: nova-core: correct RISC-V HALTED field - clk: sunxi-ng: mux: fix determine helper rate propagation - ASoC: spacemit: rename clock inputs to match binding - perf evsel: Add bounds checking to trace point raw data accessors - perf trace: Correct default cpumask formatting to hexadecimal - selftests/bpf: Fix missing allocation null checks in test_progs.c - pinctrl: Kconfig: drop unneeded dependencies on OF_GPIO - pinctrl: PINCTRL_STMFX should depend on CONFIG_OF - pinctrl: fix unmet dependencies from missing GPIOLIB - liveupdate: reject nonzero reserved value for SESSION_FINISH - liveupdate: Reference count outgoing FLB data - scsi: ufs: rpmb: Validate request frame length before parsing - ACPI: bus: Avoid confusing complaints regarding missing _OSC features - PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node - PCI/pwrctrl: tc9563: Power off only the external ports in tc9563_pwrctrl_disable_port() - gpu: nova-core: build SetRegistry entries dynamically - gpu: nova-core: fix packed registry table size - perf ui hists: In report UI ensure thread is set with reference counting - remoteproc: qcom: pas: Add late attach support for subsystems - remoteproc: qcom: q6v5: Request shutdown if crash is triggered host-side - PCI: Make pci_match_one_device() match on ID instead of device - PCI: Fix dyn_id add TOCTOU - clk: rockchip: Fractional PLL coefficient on RK3588/RK3576 is two's complement - clk: spacemit: k3: fix missing /2 factor in i2s sysclk dividers - nvme-pci: return error when parsing a quirk string fails - media: qcom: iris: Remove duplicate HFI_PROP_OPB_ENABLE entry - s390/vdso: Pass --eh-frame-hdr to the linker - regulator: tps65185: handle gpiod_get_value_cansleep() error returns - md/raid5: fix lockless max_nr_stripes reads - md/raid1: restrict atomic write limits and handle runtime constraints - PCI: dwc: ep: Clear MSI iATU mapping in dw_pcie_ep_cleanup() - soc: qcom: pmic_glink_altmode: Define the TBT extradata properly - arm64: dts: qcom: talos: Fix cpu6 1094.4MHz OPP frequency typo - arm64: dts: qcom: kaanapali: Fix the PCIe iommu-map entries - arm64: dts: qcom: monaco: Fix the PCIe iommu-map entries - arm64: dts: qcom: qcs6490-radxa-dragon-q6a: Fix the PCIe iommu-map entries - platform/chrome: lightbar: Limit payload to max packet size - clk: qcom: dispcc-qcm2290: Move to the latest common qcom_cc_probe() model - clk: qcom: dispcc-qcm2290: Enable runtime PM support - clk: qcom: qcm2290: Set POLL_CFG_GDSCR flag for DISPCC and GPUCC GDSCs - clk: qcom: qcm2290: Add RETAIN_FF_ENABLE flag for DISPCC and GPUCC GDSCs - clk: qcom: qcm2290: Update DISPCC and GPUCC GDSC *wait_val values - clk: qcom: gpucc-qcm2290: Drop pm_clk handling - clk: qcom: gpucc-qcm2290: Move to the latest common qcom_cc_probe() model - clk: qcom: gpucc-qcm2290: Keep the critical clocks always-on from probe - iomap: avoid memset iomap when iter is done - wifi: mt76: mt792x: add common USB transport reset helpers - wifi: mt76: mt7921u: escalate broken USB transport to device reset - wifi: mt76: mt792x: stop USB register access after bus hang - wifi: mt76: connac: add NAN connection type - wifi: mt76: add init_wiphy callback - wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll - wifi: mt76: fix HE DCM max-RU capability encoding - wifi: mt76: decode the full VHT Rx STBC capability field - wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode - wifi: mt76: report data NSS for STBC frames in RX rate decode - drm/msm/dpu: Fix DMA SSPP REC block offsets on DPU v13 - ARM: tegra: Fix OF node reference leaks in IRQ init - arm64: tegra: Fix CMDQV interrupt type on Tegra264 - perf unwind-libdw: Fix unwinding of multi-threaded processes - perf libdw: Fix outer-frame name resolution and spurious "(inlined)" tag - wifi: mt76: add offchannel check to mt76_roc_complete - wifi: mt76: check chanctx before restoring channel after ROC - wifi: mt76: optimize ROC for same-channel case - wifi: mt76: send nullfunc PS frames on offchannel transitions - wifi: mt76: set MT76_SCANNING when starting a hw scan - wifi: mt76: mt7996: do not leave state behind after a failed WED attach - wifi: ath12k: fix encrypted EAPOL TX in encap offload mode - objtool/klp: Fix module name normalization for paths with dots - objtool/klp: Normalize Module.symvers paths to module names - objtool/klp: Fix false module dependencies caused by dead relocs - objtool/klp: Extricate checksum calculation from validate_branch() - objtool/klp: Create empty checksum sections for function-less object files - objtool/klp: Fix --debug-checksum for duplicate symbol names - objtool/klp: Add "objtool klp checksum" subcommand - livepatch/klp-build: support patches that add/remove files - livepatch/klp-build: switch to GNU patch and recountdiff - livepatch/klp-build: report patch validation fuzz - klp-build: Suppress excessive fuzz output by default - modpost: Add __llvm_covfun and __llvm_covmap to section_white_list - objtool/klp: Remove "objtool --checksum" - objtool: Grow __cfi_* prefix symbols for all CFI+CALL_PADDING - [Config] Remove PREFIX_SYMBOLS from configs. - objtool/klp: Add .klp.symid for sympos disambiguation - klp-build: Print "objtool klp diff" command in verbose mode - klp-build: Use "objtool klp checksum" subcommand - objtool/klp: Fix symbol resolution for duplicate data symbols - powerpc/xive: make xive IPI allocation NULL-safe - powerpc/xive: add error return value to xive_smp_probe() - powerpc/xive: propagate IPI init errors to prevent use-after-free - PCI: dwc: ep: Fix unmap potentially unmapping the wrong iATU - HID: asus: fix a off-by-one in mcu_parse_version_string() validation - block/blk-iolatency: account per-cpu latency stats over possible CPUs - ocfs2: validate inline xattr header before ibody lookups - ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full() - ublk: clear auto buf reg before updating io->buf in batch commit - ALSA: hda/realtek: ALC269 fixup for Yoga/Legion Mic noise - PCI/sysfs: Add static PCI resource attribute macros - selftests/mm: fix mmap() return value check in run_migration_benchmark - selftests/mm: fix memleak in migration benchmark - arm64: dts: qcom: sa8540p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: sdm845: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: sdm850: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: sm8150: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: sm8250: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: sm8350: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: sm8450: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: sm8550: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: qcm6490: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: qcs6490: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: sc7180: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: sc7280: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: sc8180x: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: hamoa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: purwa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: sm8650: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: sm8750: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: lemans: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies - arm64: dts: qcom: sa8155p-adp: Fix swapped USB and UFS QMP PHY vdda- phy/vdda-pll supplies - perf header: Use write lock when translating BPF prog info pointers - ocfs2/heartbeat: fix slot mapping rollback leaks on error paths - bpf: Factor callchain_store function from __bpf_get_stack - bpf: Factor callchain_finalize function from __bpf_get_stack - bpf: Remove trace_in argument from __bpf_get_stack - perf c2c: Fix error masking, OOM, and unchecked caller errors in hpp_list__parse() - perf c2c: Clean up registered formats on c2c_hists__init() and c2c_hists__reinit() failure - drm/sun4i: Fix V3s YUV scanline size - drm/sun4i: vi scaler: Restore opaque alpha in video modes - drm/sun4i: tcon-top: Keep mixer routes distinct - drm/sun4i: Drop node references while building component list - soundwire: cadence_master: add BRA_NumBytes[8] support - tools: Ensure tools copy of linux/filter.h exports the UAPI - drm/gfx12: Program DB_RING_CONTROL - drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 - ALSA: hda: cix-ipbloq: Avoid build with 32bit archs - PCI: cadence: Fix host/endpoint dependencies for cadence-plat driver - selftests/mm: unpoison pages in memory-failure teardown - ext4: teach ext4_meta_trans_blocks() about number of allocated extents - ext4: fix transaction overflow during writeback - coresight: etm4x: Set active path on target CPU - ACPI: PCI: Avoid misleading _OSC messages for non-PCIe host bridges without _OSC - scsi: sd: Enable sector size > PAGE_SIZE in SCSI sd driver - btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock - perf sched: Suppress latency table output when trace samples are missing - perf header: Add utility to convert feature number to a string - perf header: Refactor pipe mode end marker handling - perf sched: Handle missing trace samples in pipe mode - perf script: Fix metric_evlist leak in script_find_metrics - perf tools: Fix sb_evlist leaks in top and record - perf python: Fix memory leak in pyrf_evlist__get_pollfd - perf python: Validate attribute setters in pyrf_evsel - perf python: Fix count_values memory leak in pyrf_evsel__read - netfilter: nft_ct: support expectation creation for natted flows - netfilter: nf_conntrack_helper: add refcounting from datapath - nfsd: add protocol support for CB_NOTIFY - lockd: Regenerate NLMv4 XDR code - xdrgen: Emit a blank line ahead of enum declarations - xdrgen: Add XDR width macros for short integer types - selftests/cgroup: Avoid awk -e in cpuset tests - pinctrl: rockchip: Decode drive strength in the get function - selftests: drv-net: Test queue stall upon reconfig - selftests: drv-net: so_txtime: remember to deploy the binaries - selftests: drv-net: so_txtime: only send test traffic to sch_etf - phy: rockchip: samsung-hdptx: Fix rate recalculation for high bpc - phy: rockchip: samsung-hdptx: Prevent divide-by-zero when computing clk rate - phy: rockchip: samsung-hdptx: Guard against clk rate integer underflow - phy: rockchip: samsung-hdptx: Fix rate recalculation for 3.2GHz FRL - phy: rockchip: samsung-hdptx: Handle uncommitted PHY config changes - objtool/klp: Fix vmlinux .klp.symid link error for .no_trim_symbol symbols - objtool/klp: Fix size of empty special section entries - objtool/klp: Ignore replacement offset of empty x86 alternatives - objtool/klp: Fix cross-module klp relocation section naming - objtool/klp: Don't match local symbols against exports - objtool/klp: Fix relocations for EXPORT_SYMBOL_FOR_MODULES() symbols - iomap: iomap_bio_read_folio_range_sync is missing a call to bio_uninit - mfd: cs42l43: Fix regmap defaults ordering - backlight: aw99706: Validate all DT property values consistently - backlight: ktd2801: Fix unmet dependency on GPIOLIB - bpf, riscv: Clear fetch destination on faulting arena atomic - bpf, x86: Clear fetch destination on faulting arena atomic - bpf: Derive the atomic load register in one place - bpf, arm64: Clear fetch destination on faulting arena atomic - ASoC: spacemit: advertise only DMA-backed DAI streams - objtool/klp: Fix vmlinux .klp.symid link error for .exitcall.exit symbols - power: supply: bd71815: Fix temperature reading - power: supply: bd71828: Fix current direction - power: supply: bd71828: Drop duplicate power-supply property - power: supply: bd71828: Do not hide errors - selftests: drv-net: so_txtime: fix qdisc replace with handle - sched/isolation: Defer freeing of cpumask memblock memory to initcall - HID: tmff: Use 64-bit arithmetic for force feedback scaling - bpf: Fix arm64 KASAN false positive after bpf_throw - ACPI: bus: Introduce acpi_bus_get_primary_device() - ACPI: platform: Use acpi_bus_get_primary_device() - ACPI: scan: Use acpi_bus_get_primary_device() - selftests/bpf: Fix selftest build after filter.h update - sched_ext: Drop unlocked scx_rq_clock_invalidate() from scx_root_disable() - smb/server: fix memory leak in ksmbd_vfs_set_durable_owner() - objtool/klp: Fix vmlinux klp relocations for EXPORT_SYMBOL_FOR_MODULES() - ksmbd: validate SMB2 write offsets - ksmbd: fix encrypted request lookup on bound channels - ksmbd: add procfs monitoring for active shares - smb/server: warn if ksmbd_proc_create() fails - smb/server: update session counter under sessions table lock - smb/server: fix session counter on session removal - selftests/bpf: Retry stat generation in cgroup_iter_memcg - NFS: Fix delayed delegation return list handling - regulator: tps65185: wait for the IC to wake before the first I2C access - can: m_can: Use of_property_present() for wakeup-source - ionic: add missing dma_rmb() after the completion publish check - netfilter: ctnetlink: do not expose expectation DEAD flag - i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode - smb: client: set replay flag on the read send-error retry path - irqchip/gic-v5: Disable IRSes on probe failures - irqchip/gic-v5: Release IRS iomem region on driver init failure - irqchip/gic-v5: Defer default SPI and LPI IAFFID programming - drm/xe: don't WARN on kernel job timeout when device already wedged - powercap: intel_rapl: Sign-extend the PMU delta on counter wraparound - ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS - net: hibmcge: fix page_pool DMA direction mismatch - net/sched: sch_cake: fix autorate reconfiguration throttling - fuse: use release/acquire for fch->initialized - f2fs: use adjusted write range after f2fs_write_checks() - Bluetooth: hci_sync: add conditional locking annotations - net: enetc: extract common helpers for MAC promiscuous mode setting - net: enetc: extract common helpers for MAC hash filter configuration - net: enetc: remove invalid code from enetc4_pl_mac_link_up() - net: enetc: restore RX ring congestion mode for ENETC v4 - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() - smb/client: pass cifs_open_info_data to SMB2_open() - smb/client: preserve open info type across compound queries - selftests/mm: fix read_file() return value check - of/irq: Fix device node refcount leak in of_irq_get_affinity() - net: phy: air_en8811h: move LED GPIO configuration to config_init - net: stmmac: selftests: Don't test flow control for small rx fifos - Revert "esp: do not unref managed frag pages in esp_ssg_unref()" - perf hists browser: Increase MAX_OPTIONS to prevent stack buffer overflow - perf ui hists: Fix dso_filter reference leak and exit zoom cleanup - perf python: Add missed explicit dependencies - EDAC/igen6: Fix Raptor Lake-P logged error address - nvme: add context annotations for nvme_subsystem::lock - nvme: set ns->head in nvme_alloc_ns_head - nvme: fix racy access to FDP placement id array - selftests/cgroup: set the test plan after the setup checks - bpf: Fix BPF_F_CPU validation for sparse CPU IDs - bpf: Fix percpu map update indexing with sparse CPU IDs - printk: Don't WARN on kthread_run failure. - selftests/cgroup: Drop invalid boot isolation comparison - cgroup/cpuset: Preserve boot-isolated CPUs on partition release - accel: ethosu: Don't read the U65 rounding mode as a storage mode - bpf: check_cond_jmp_op(): properly infer if register is null - net: stmmac: helpers for filling tx_q->tx_skbuff_dma - net: stmmac: add helper to get hardware transmit descriptor - net: stmmac: fix dma mapping leak in stmmac_tso_xmit() - scsi: ufs: core: Introduce a new ufshcd vops negotiate_pwr_mode() - smb/client: fix stale page cache in insert/collapse range - smb/client: invalidate fscache for fallocate range operations - netfs: Fix readahead synchronisation issues by loading all folios upfront - netfs: Mark folios with COPY_TO_CACHE whilst issuing subreqs - netfs: Fix read progress reporting - drm/i915/cdclk: Fix dg2_power_well_count() return type - ovl: return EINVAL instead of EIO in case of mismatched user_ns - smb/server: cancel async requests when closing connection - ksmbd: safely drain sessions during logoff - ksmbd: fix listener task lifetime on netdev events - s390/pai: Reduce excessive debug feature size - ASoC: ab8500: Skip missing DMIC GPIOs on AB8505 - drm/pagemap: Prevent double migration of device pages - drm/pagemap: Reset migration page count on eviction retry - rust: samples: add missing newlines in rust_print_main - klp-build: Fix wrong index in funcs cleanup error path - objtool/klp: Fix checksums for constant pool references - ipv6: mcast: fix delay calculation in igmp6_join_group() - ipv6: mcast: use rcu_assign_pointer() for __rcu list updates - ipv6: mcast: use jiffies_delta_to_clock_t() in igmp6_mc_seq_show() - net: bonding: annotate lockless writes with WRITE_ONCE() - ASoC: cs35l56: Request IRQ in cs35l56_common_probe() - ASoC: cs35l56: Fix probe deadlock waiting for SoundWire enumeration - sched/core: Skip rq->avg_idle update without a valid idle_stamp - ksmbd: fix sparc build with atomic work state - bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge - bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks - net: macb: exclude software FCS from TX byte statistics - powerpc: Don't drop _TIF_RESTOREALL on syscall restart - bpf: Reject key-less BTF for hash maps - bpf: Mark syscall helpers as sleepable - ring-buffer: Add checking nr_subbufs to persistent ring buffer validation - nvme: print namespace IDs as unsigned 32bit value - nvmet: print namespace IDs as unsigned 32bit value - bpf: zero extend the result of an arena 32-bit cmpxchg - bpf: don't rewrite bpf_fastcall patterns entered by a jump - bpf: Don't infer non-NULL from a pointer with an unbounded offset - bpf: detect non null pointer with register operand in JEQ/JNE. - bpf: Mark the zero register precise for a register-form NULL check - bpf: Mark NULL kptr stores precise - bpf: Preserve inner map identity in callback frames - ring-buffer: Remove ring_buffer_per_cpu::mapped - tracing: Fix subbuf resize races with trace_pipe_raw readers - ring-buffer: Cap static ring buffer nr_pages - tracing: Fix comment in tracing_buffers_splice_read() - bpf: mark a NULL call argument precise - bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero() - net/mlx5e: Fix reporting support for all RS FEC variants - erofs: delimit inode_share cache key components - iommu/riscv: Serialize command queue publishing - iommu/riscv: Avoid waiting on failed command enqueue - iommu/amd: Fix ineffective error check in nested domain allocation - regulator: pf1550: fix which regulator is notified - virtio_ring: fix stale descriptor flags after a failed packed add - vduse: validate virtqueue alignment - vhost: invalidate vring access on IOTLB transitions - vduse: return compat ioctl results directly - net: macb: zero the link settings taprio reads back - net: macb: reject an unknown link speed in the taprio setup - Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform - nstree: check listing permission before taking a namespace reference - drm/xe: Guard page-fault worker with runtime PM check - net: phylink: initialise link_state before a forced major config - drm/i915/dp: Gate UHBR SST SDP splitting on sink capability - block: Fix start and length check added to iov_iter_extract_bvecs() - ublk: clear force_abort in ublk_queue_reset_io_flags() - tracing: Fix ring_buffer_read_page_size() kernel-doc - x86/MCE/AMD: Fix inverted interrupt enablement during storm handling - ftrace: Use rcu_assign_pointer() for tmp_ops filter hash - tracing: Take trace_array reference when opening a tracer options file - tracing: Don't dereference trace_event_file in deferred trigger free - rust: num: seal Integer - rust: pin-init: use irrefutable pattern for `stack_pin_init` - riscv: hwprobe: initialize pair->value in hwprobe_one_pair() - drm/amdgpu: statically assign gart windows to ttm entities - drm/amdgpu: skip the VMID 0 flush for VRAM - accel: ethosu: Fix ethosu_job_open() return value - accel: ethosu: Drop IRQF_SHARED flag - accel: ethosu: Ensure cmd stream ends with a stop op - accel: ethosu: Ensure SRAM size is 0 on mapping failure - accel: ethosu: Validate SRAM size on submit - accel: ethosu: Ensure SRAM region size matches job - ata: pata_legacy: remove documentation for removed module parameters - drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 - drm/amd/display: Exit IPS before connector detection on resume - selftests: ublk: install test_common.sh and trace/ scripts - media: rkvdec: bound HEVC tile loops and PPS id to the array capacity - selftests: mptcp: lib: dump nstat for the right test - selftests: mptcp: lib: get counters for the right test - smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() - cifs: validate full SID length in security descriptors - smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid - smb: client: fix uid/gid override in getattr with posix extensions - smb: client: fix cifsFileInfo reference leak in deferred close - smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() - xfs: lock the healthmon when inserting unmount event - xfs: fix under-reservation of blocks when repairing sf directories - xfs: fix media verification ioctl for internal rt volumes - xfs: don't stash removename operations with unknown ftype - xfs: check healthmon outbuffer space correctly - xfs: bump lost_prev_errors if we lose even the healthmon lost event - xfs: always set xfs_healthmon::first_event when inserting at front of list - ASoC: cs35l56: Fix race between kexec and snd_soc_register_component() - hwmon: (asus_rog_ryujin) Add per-device configuration - hwmon: (asus_rog_ryujin) Validate HID report lengths - hwmon: (asus_rog_ryujin) Synchronize HID command and report handling - f2fs: fix to shrink gc_lock coverage in f2fs_gc_range() - f2fs: fix to reset all pinned status during fggc - drm/i915/cdclk: Avoid spurious cdclk sanitization on PTL+ - accel/amdxdna: Disable device buffer exporting - drm/xe/i2c: Assert/Deassert I2C IRQ - drm/xe/i2c: Fix the interrupt handling - s390/pai: Use PAI PMU index as parameter replacing event - s390/pai: Move locking to event init and delete - s390/pai: Support CPU hotplug for PMU PAI - Upstream stable to v6.18.52, v6.18.53, v7.2.6, v7.2.7 * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90061 - netfilter: nf_tables: skip double clone set expressions on element insert * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90079 - octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90082 - net: mana: Cap MSI-X vectors to the device MSI-X table size * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90087 - Bluetooth: do not leak an hci_conn when a second LE connect is rejected * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90093 - Bluetooth: L2CAP: access chan->conn safely in get/setsockopt * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90095 - fuse: Fix the condition to enable over-io-uring * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90099 - net/sched: account classifier filter allocations to memcg * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90104 - NFSv4.1: zero referring call lists before decoding * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90105 - vxlan: fix reading neigh ha * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90106 - net: bridge: arp/nd proxy: fix reading neigh ha * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90111 - ip6mr: do not clone dst in ip6mr_cache_report() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90120 - irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90121 - irqchip/gic-v5: Clear per-CPU IRS data on teardown * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90142 - virtio_net: Fix resize of the RX ring * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90154 - ksmbd: scope session state changes to bound connections * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90156 - ksmbd: safely discard unregistered deferred locks * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90163 - smb/server: call ksmbd_proc_cleanup() on module init failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90164 - smb/server: abort initialization when proc setup fails * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90174 - ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90177 - bpf: Check pointer type for all atomic RMW paths * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90182 - blk-iocost: clear delay state when freeing policy data * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90183 - blk-iolatency: clear delay state when freeing policy data * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90206 - nvmet: fix max_qid race between configfs and controller allocation * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90208 - clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90211 - bpf, s390: Clear fetch destination on faulting arena atomic * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90212 - arm64/efi: Avoid voluntary preemption with efi_mm installed * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90217 - bpf: Compare iterator types during state pruning * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90231 - apparmor: fix unconfined user namespace restriction forced stack * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90234 - NFS: Return a delegation the client fails to record * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90237 - netfilter: nft_ct: move custom expectation support to helper * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90242 - iommu/vt-d: Fix iopf_refcount leak on RID domain replacement * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90246 - apparmor: fix integer overflow in verify_tags() bounds check * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90256 - Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90261 - btrfs: zoned: flush active metadata block group at btree_writepages() start * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90263 - btrfs: check if root is readonly when setting posix acl * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90267 - scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90270 - arm_mpam: Disable driver unbind to avoid UAF * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90271 - arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90273 - coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90288 - phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90289 - drm/amd/display: Resize MST HDCP per-connector arrays to 32 * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90300 - bpf: Clear buf on error in __bpf_get_task_stack * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90301 - ocfs2: o2hb: quiesce negotiate handlers and timeout work * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90310 - xen/xenbus: check otherend_id only after it has been initialized * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90311 - thermal: hwmon: Remove hwmon class device along with its parent * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90315 - PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90320 - ocfs2: validate external xattr entries when reading metadata * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90321 - ocfs2: validate inline xattrs during inode block validation * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90323 - ublk: validate auto buf reg before taking uring_cmd * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90330 - HID: logitech-hidpp: Fix FF device cleanup on init failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90331 - HID: asus: refactor the two workqueues and init sequence * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90332 - PCI: dwc: ep: Flush cached MSI write before unmapping the iATU * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90335 - tty: skip cdev_del() when no cdev is registered * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90336 - serial: core: clear freed pointers on uart_register_driver() failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90337 - serial: core: do fallible allocations before the console can be registered * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90342 - bpf: Fix mmap_lock deadlock on arena lock failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90345 - wifi: brcmfmac: fix P2P action frame handling without device vif * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90346 - wifi: nl80211: clean up color-change beacon data on errors * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90347 - arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90355 - wifi: mt76: mt7996: clear stale link state on full reset * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90359 - bpf: Reject >8 byte return values on return-reading trampoline paths * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90365 - wifi: mt76: cancel reset and rc work on device unregister * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90369 - wifi: mt76: fix out-of-bounds access in mmio copy helpers * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90380 - wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90381 - wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90384 - iomap: release the folio batch on iomap callback failures * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90401 - md: remove REQ_NOWAIT support from raid1/10/456 * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90408 - wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90409 - drm/panthor: Add vm_bind region with kbo range overlap check * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90412 - nvmet: fix return status of RMI log page on allocation failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90417 - RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90421 - PCI: Fix UAF when probe runs concurrent to dyn ID removal * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90427 - iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92479 - scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92480 - scsi: ufs: core: Validate string descriptors * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92482 - pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92483 - liveupdate: Remember FLB retrieve() status * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92485 - bpf: Fix WARNING in bpf_tracing_link_release * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92503 - ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93043 - bpf: Disallow interpreter fallback for gotox insn * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93044 - bpf: Disallow interpreter fallback for arena-related insns * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93047 - drm/v3d: Associate BOs with every job that accesses them * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93069 - OPP: Fix cleanup ordering * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93081 - firmware: arm_scmi: Fix SCMI device destroy lifetimes * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93094 - wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93096 - cxl/features: Serialize multi-part Get/Set Feature transfers * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93099 - fs/resctrl: Fix UAF from worker threads when domains are removed * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93104 - RDMA/rvt: Return NULL after port allocation failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93105 - esp: do not unref managed frag pages in esp_ssg_unref() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93116 - platform/x86: asus-wmi: fix resource leaks on probe failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93122 - usb: gadget: uac: validate rate list length before storing * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93125 - bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93127 - bpf: Drop scalar id on sign-extending narrowing stack fills * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93129 - platform/x86: dell-wmi-base: Fix handling of ultra performance key * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93135 - bpf: Reject programs with inlined helpers if JIT is not available * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93144 - bpf: Reject writes through untrusted BTF pointers * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93148 - bpf: Reject MEM_ALLOC BTF accesses past object bounds * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93153 - RDMA/bng_re: return a timeout when firmware responses stall * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93164 - uprobes/x86: Move optimized uprobe from nop5 to nop10 * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93168 - dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93176 - drm/amd/display: Fix dangling pointer in plane reset function * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93179 - drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93181 - perf/x86/intel/uncore: Fix uncore_box ref/unref ordering * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89788 - ksmbd: fix tree connection use-after-free in smb2_tree_connect() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93201 - dm-pcache: validate seg_id fields from persistent memory * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89792 - ksmbd: prevent out-of-bounds reads in share config responses * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90051 - tcp: reject non zerocopy devmem tx * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90053 - net/sched: sch_htb: limit htb_classify inner-class filter hops * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90054 - tcp: fix corruption of urgent data on multi-segment retransmit * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90055 - usb: atm: usbatm: fix invalid ci_range initialization * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90056 - net: fec: only stop PTP if it was initialized * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90057 - slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90058 - net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90059 - net: stmmac: restore NET_IP_ALIGN in the RX DMA offset * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90060 - ALSA: control: Don't add invalid kcontrols to LED layer * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90062 - netfilter: nf_tables: move hardware offload step after building the chain blob * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90063 - virtio-net: Ensure that TCP packets don't overflow gso_segs * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90065 - net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90066 - samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi- modify * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90067 - libceph: validate banner payload length * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90068 - ASoC: dapm: Fix off-by-one check on the second enum channel * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90069 - crypto: acomp - allocate async request context when cloning * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90070 - tpm: st33zp24: Return zero on status read failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90071 - net/sched: sch_teql: restore skb->dev on the slave failure path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90072 - net/sched: sfq: clamp quantum to avoid signed overflow soft lockup * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90073 - net/sched: hhf: clamp quantum before hhf_change() to avoid overflow * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90074 - net/sched: fq_pie: clamp default quantum to avoid signed overflow * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90075 - net/sched: fq_codel: clamp default quantum and mtu * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90076 - net/sched: fq: add overflow bounds to quantum and initial quantum * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90077 - net: fix a resource leak in copy_net_ns() error handling path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90078 - net/sched: act_skbmod: fix length calculations and avoid invalid header warnings * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90080 - octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90081 - net/rds: use wq_has_sleeper() in rds_cong_map_updated() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90083 - net/sched: act_ife: Only operate on Ethernet frames * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89780 - net: qualcomm: rmnet: restore skb->dev on deaggregated frames * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90084 - octeontx2-vf: fix workqueue and netdev race in probe/remove * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90085 - octeontx2-af: fix NULL deref in NIX TM tree debugfs read path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89789 - gtp: add synchronize_net() in gtp_newlink() error path to prevent use- after-free * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90086 - xsk: honor XDP_TX_METADATA in zero-copy path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90088 - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90089 - Bluetooth: btnxpuart: Validate the FW dump header length * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90090 - Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90091 - Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90092 - Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90094 - arm64: process: Fix context switching MTE store-only tag check * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90097 - Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90100 - ptp: netc: fix period truncation and potential divide-by-zero in PEROUT * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90101 - bnxt_en: Fix call to hardware monitoring event handler * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90102 - NFSv4/pnfs: key the data server cache on the NFS version * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90103 - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90107 - net/smc: free pending qentry in smc_llc_flow_stop() before memset * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90108 - net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90109 - net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90110 - inetpeer: randomize RB-tree node comparison using SipHash * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90112 - net: qlcnic: validate unified ROM sections before loading * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89790 - ipv6: avoid divide by zero in rt6_multipath_rebalance * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90113 - netdevsim: update queue NAPI association on queue reset * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90114 - net: bridge: Reject descending VLAN tunnel ranges * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90115 - xsk: fix NULL pointer dereference in __xsk_rcv() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90116 - ALSA: mtpav: shut down output timer before card teardown * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90119 - ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90122 - clk: visconti: Make sure clk_init_data is fully initialized * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90124 - irqchip/renesas-rzg2l: Fix loss of interrupt * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90125 - smb: client: fix request buffer leak in smb2_new_read_req() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90126 - rtc: pcf8563: fix clock provider leak on unbind * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90127 - virtio: rtc: time out alarm requests * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90128 - vdpa/mlx5: fix wrong list iterated in add_direct_chain error path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90129 - virtio_balloon: quiesce balloon work before device shutdown * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90130 - vdpa_sim: fix cleanup after worker creation failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90135 - net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90136 - platform/x86/amd/hsmp: Reject negative power cap writes in hwmon * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90137 - platform/x86: hp-bioscfg: fix password encoding bounds check * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90138 - vsock: don't check the listener's sk_err in vsock_accept() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90139 - fuse: check for NULL root inode in fuse_fill_super_submount * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89779 - fs/ntfs3: validate ef->size covers the record's name and value * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89781 - fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90140 - cuse: wait for pending RCU callbacks on module exit * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89776 - vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90141 - ipvs: fix integer overflow in ftp helper port/address parsing * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90143 - net: kcm: Hold RCU read lock while running BPF parser * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90145 - hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90146 - bpf, xdp: move offload check into dev_xdp_install() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90147 - clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90148 - NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90149 - NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90150 - pnfs/blocklayout: Fix device leaks on parse failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90151 - NFSv4: remove callback IDR entry on client allocation failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90152 - smb/server: fix session leak in ksmbd_session_register() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90153 - ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90157 - bpf: Reject negative optlen in cgroup getsockopt hook * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90158 - m68k: nfcon: Do not call console_is_registered() in nfcon_device() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90159 - bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90160 - lwt_bpf: Restore reserved headroom after xmit program * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90161 - erofs: fix interlaced ztailpacking pclusters * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90165 - smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90166 - smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90169 - ksmbd: free preauth sessions on connection teardown * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90170 - ksmbd: validate ipc response length before dereferencing its fields * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90175 - smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90176 - ksmbd: Do not skip lock checks for single-byte ranges * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90178 - hwmon: (coretemp) Fix core_data leak on CPUs without PTS * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90179 - apparmor: fix deadlock in complain-mode change_hat * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90180 - block: mtip32xx: synchronize ioctls with device removal * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90184 - null_blk: serialize configfs attribute updates with device setup * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90185 - null_blk: serialize configfs attribute stores with the lock * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90186 - null_blk: reject per-device queue resize for shared tag set * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90187 - null_blk: free zones array on device power-off * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90188 - null_blk: free global tag_set on init error path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90189 - null_blk: register configfs subsystem after creating default devices * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90190 - null_blk: use DEFINE_MUTEX for the file-scope mutex * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90191 - mailbox: riscv-sbi-mpxy: validate RPMI notification lengths * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90192 - mailbox: qcom-cpucp: handle NULL data in send_data callback * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90193 - mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90194 - ACPI: scan: fix bus ID cleanup on device_add() failures * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90195 - riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90196 - ASoC: SOF: validate topology volume range before allocation * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90197 - HID: haptic: don't write an uninitialized value to unhandled usages * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90198 - ALSA: core: Fix use-after-free in snd_card_do_free() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90199 - fs/ntfs3: reject out-of-range evcn in mi_enum_attr() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90200 - fs/ntfs3: fix integer overflow in MFT cluster validation * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90201 - net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90202 - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90203 - Squashfs: check block offset is not negative * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90204 - ocfs2: validate DIO orphan slot during inode read * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90205 - ocfs2: validate orphan slot during inode read * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90207 - ALSA: seq: midi: Serialize input teardown with event_input * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90209 - s390/debug: Fix deadlock during unregister * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90213 - firewire: core: fix memory leak in error path of build_tree() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90214 - ASoC: xilinx: formatter_pcm: fix stream_data leak on open error * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90215 - mtd: ubi: Release device reference on busy detach * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90216 - ubi: Fix rollback for explicit UBI device numbers * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90218 - RDMA/cma: Fix WARNING in res_to_rt * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90219 - RDMA/cxgb4: Free debugfs on registration failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90220 - ALSA: seq: Don't leak the extension cell pointer in the bounce payload * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90221 - nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90222 - nfc: pn533: hold a reference to the request skb during send_frame * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90223 - nfc: llcp: bound SNL TLV parsing to the skb and add length checks * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90224 - nfc: nci: fix double completion race in nci_data_exchange_complete * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90225 - nfc: llcp: read llcp_sock->local under the socket lock in getsockopt * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90226 - nfc: llcp: avoid userspace overflow on invalid optlen * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90227 - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90228 - nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90229 - nvme-apple: Destroy the admin queue on removal * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90230 - nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90232 - amt: Don't support cross-netns setup. * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90233 - nvme-pci: release descriptor pools on probe failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90235 - sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89784 - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90240 - iommu/vt-d: Flush context cache with correct SID when tearing down aliases * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90241 - iommu/vt-d: Tear down scalable-mode context on probe failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90243 - iommu/vt-d: Clear Present bit before tearing down copied context entry * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90244 - iommu/dma: Restore locking around msi_page_list * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90245 - fbdev: kyro: Validate overlay viewport coordinates * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90247 - bpf: Fix mmap_lock leak in irq_work path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90248 - net/sched: cls_api: fix teardown of an adopted proto on insert-race loss * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90249 - iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90250 - bpf, cgroup: Fix storage null-ptr-deref after replacing prog * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90251 - Bluetooth: MSFT: validate evt_prefix_len against the response length * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90252 - Bluetooth: MGMT: free the HCI command when it is cancelled * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90253 - Bluetooth: MGMT: free the mesh send cancel command when it is cancelled * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90254 - Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90255 - Bluetooth: hci_conn: fix the SCO setup context lifetime * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90257 - Bluetooth: virtio_bt: avoid OOB read of build info string * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90258 - pinctrl: airoha: add missed IRQ resource helpers * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90259 - btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90260 - btrfs: zoned: don't clobber the extent buffer when zeroing it out * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90262 - btrfs: retry verity reads for not-uptodate Merkle folios * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90264 - btrfs: always wait for ordered extents to avoid OE races * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90265 - btrfs: defrag: fix deadlock between defrag and delalloc space reservation * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90269 - bpf: Reject load-acquire from pointers requiring fault protection * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90272 - perf: arm_pmuv3: Zero initialize hw_id branch stack field * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90274 - coresight: etm4x: fix underflow for usage of (nrseqstate - 1) * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90275 - md/raid1: don't set array_frozen in raid1_takeover() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90276 - md/md-llbitmap: stop daemon timer rearm on destroy * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90277 - md/md-llbitmap: prevent create failure bitmap UAF * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90278 - md: wait for behind writes before destroying bitmap * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90279 - md/raid5: round bitmap stripes with sector division * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90280 - phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90281 - phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90282 - phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90283 - hugetlbfs: release subpool on fill_super failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90284 - firmware_loader: do not queue completed sysfs fallback requests * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90285 - scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90286 - drm/amdgpu/gfx6: Use PFP on the compute queues too * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90287 - phy: sunplus: fix error handling in sp_uphy_init() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90290 - arm64: hibernate: Restore DAIF state on error * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90291 - module/dups: Fix use-after-free in kmod_dup_req lifetime handling * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90292 - RDMA/siw: Fix use-after-free in siw_accept() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90293 - IB/isert: post the full-feature receive buffers after session registration * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90294 - IB/isert: delay the final Login Response until the session is registered * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90295 - cpufreq: imx6q: fix out-of-bounds write when probed more than once * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90296 - cpufreq: imx6q: fix devres accumulation across driver rebind * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90297 - drm/sun4i: crtc: Propagate layer initialization error * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90298 - drm/sun4i: tcon: Drop TCON TOP device reference * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90302 - ocfs2: synchronize heartbeat callbacks with o2net teardown * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90303 - ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90306 - ARM: 9481/2: breakpoint: CFI breakpoints only on demand * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90307 - RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90308 - RDMA/erdma: Hold QP references for AE and CM processing * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90309 - RDMA/erdma: Hold CQ references when processing EQ events * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90312 - bpf: Check load-acquire src ptr type before the load * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90313 - bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90314 - remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90316 - drm/omap: dsi: Do not copy isr table * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90318 - fat: release buffer head after rebuilding parent * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90319 - rapidio: clear mport->net when rio_add_net() fails * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90322 - ocfs2/cluster: keep heartbeat local node stable * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90324 - ublk: check import_ubuf() return value * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90325 - blk-cgroup: skip dying blkg in blkcg_activate_policy() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90326 - blk-cgroup: fix race between policy activation and blkg destruction * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90327 - phonet: pep: do not write beyond optlen in getsockopt * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90328 - HID: steam: Reject short reads * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90329 - HID: synchronize input before cleaning up a failed probe * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90333 - dm-integrity: replace forgeable discard filler with a keyed sector marker * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90334 - tty: clear cdev pointer after cdev_add() failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90338 - serial: amba-pl011: keep console clock enabled for atomic writes * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90341 - firmware: coreboot: Validate table bounds * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90343 - wifi: cfg80211: stop PMSR before P2P and NAN teardown * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90344 - wifi: mac80211: disconnect on CSA to channel 0 * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90348 - wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90349 - wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90350 - wifi: mt76: reject out-of-range link ids in mt76_vif_link() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90351 - wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90352 - wifi: mt76: mt7915: release hif2 reference on probe IRQ failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90353 - wifi: mt76: mt7915: fix ext PHY use-after-free on register error path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90354 - wifi: mt76: mt7915: fix double hif2 init on the non-WED path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90356 - wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90357 - wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90358 - bpf, x86: Fix trampoline stack size for 128-bit arguments * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90360 - regulator: core: use system_freezable_wq for init complete work * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90361 - wifi: ath11k: fix leak in ath11k_service_ready_ext_event() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90362 - drm/msm/dsi: Drop dev_pm_opp_set_rate(0) * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90363 - drm/msm: don't tear down KMS twice when KMS init fails * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90364 - ACPI: processor: Unregister cpufreq notifier on init failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90366 - wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90367 - wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90368 - wifi: mt76: mt7915: unwind state on add_interface failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90370 - wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90371 - wifi: mt76: fix RXDMAD_C buffer recycling race * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90372 - wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90373 - wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90374 - wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90375 - wifi: mt76: fix non-AQL packet accounting for MLO stations * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90376 - wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90377 - wifi: mt76: fix RX data queuing of RRO 3.0 * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90378 - wifi: mt76: mt792x: Fix memory leak in SDIO TX path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90379 - wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90382 - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90383 - misc: sgi-gru: remove interrupt-context page-table walks * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90385 - md/raid1: create serial pool adding rdev to array with serialize_policy=1 * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90386 - i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90387 - swiotlb: Preserve allocation virtual address for dynamic pools * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90388 - iommu/dma: Check atomic pool allocation result directly * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90389 - md: scope memalloc_noio to allocation critical sections * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90390 - md/bitmap: resume array on backlog_store() error path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90391 - lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90392 - bpf: Fix potential UAF when reading bpf link info * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90393 - bpf: Fix potential UAF in bpf_netns_link_update_prog * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90394 - power: supply: sc2731_charger: cancel work on remove * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90395 - power: supply: isp1704_charger: cancel work on remove * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90396 - block: fix dio leak on metadata mapping error * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90397 - firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90398 - wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90399 - wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90400 - md: recheck spare changes before starting sync * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90402 - bus: mhi: host: Fix controller cleanup on EDL sysfs failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90403 - wifi: rtlwifi: pci: fix error path in rtl_pci_probe() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90404 - platform/chrome: cros_ec_debugfs: Unregister panic notifier * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90406 - media: qcom: iris: handle runtime PM resume failure in core deinit * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90407 - wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90410 - spi: davinci: switch to managed controller allocation * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90411 - nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90413 - IB/isert: reject login PDUs declaring more data than was received * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90414 - IB/isert: reject PDUs declaring more data than was received * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90415 - RDMA/cxgb4: free STAG index when TPT entry write fails * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90416 - RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90418 - nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90419 - nilfs2: prevent out-of-bounds read in super root block parsing * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90420 - nilfs2: fix infinite loop in nilfs_clean_segments() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90422 - clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90423 - RDMA/rxe: Fix UAF in ODP init error-handling path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90424 - iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90425 - iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90426 - iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90428 - iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90429 - iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90430 - iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89782 - fs/ntfs3: reject restart table growth beyond U16_MAX entries * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90431 - remoteproc: Prevent crash handling to race with rproc_del() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90433 - spi: oc-tiny: switch to managed controller allocation * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90434 - isofs: release zisofs block pointer buffer head * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-90435 - RDMA/mlx5: Fix integer overflow of user QP buffer size * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92476 - crypto: keembay - Initialize completion before requesting IRQ * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92477 - scsi: ufs: debugfs: Reserve space for a string terminator * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92481 - pinctrl: mediatek: free EINT resources on unbind * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92484 - cxl/region: Fix use-after-free in find_pos_and_ways() error path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92486 - bpf: Fix CFI mismatch in task work callback * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89785 - fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92488 - RDMA/erdma: complete object teardown when the destroy command fails * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92489 - xfrm: Fix skb double-free in xfrm_dev_direct_output() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92490 - firmware: arm_scmi: Unrequest devices if driver registration fails * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92491 - firmware: arm_scmi: Roll back partial protocol table registration * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92493 - cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89787 - ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92494 - ext4: fix buffer_head leak in ext4_init_orphan_info * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92495 - RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92496 - wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92497 - wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92498 - wifi: ath6kl: avoid buffer overreads in WMI event handlers * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92499 - ext4: validate readdir offset before accessing dirent * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92500 - ext4: use fsdata to track inline data write state and fix race * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92501 - ext4: drain in-flight DIO before buffered write fallback * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92504 - thermal: intel: int3400: clean up ODVP on probe failures * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92505 - iommu/amd: Fix undefined behavior in devid_write debugfs function * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92506 - firmware: arm_scmi: Fix requested device removal race * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92507 - RDMA/core: Fix potential use after free in ib_dealloc_pd_user() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92508 - RDMA/core: Fix potential use after free in ib_free_cq() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92509 - RDMA/core: Fix potential use after free in counter_release() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92510 - RDMA/core: Fix potential use after free in ib_destroy_srq_user() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92511 - RDMA/core: Fix potential use after free in ib_destroy_cq_user() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92512 - RDMA/core: Fix use after free in ib_query_qp() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92513 - RDMA/mana_ib: drain QP references after partial table insertion * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92514 - RDMA/erdma: Fix CEQ tasklet use-after-free on removal * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92515 - bpf: Preserve unique-field state across nested structs * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92516 - bpf: Fix offset warn check for bpf_res_spin_lock * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92517 - bpf, riscv: Fix extable handling for arena load_acquire * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92518 - riscv, bpf: Fix kernel stack corruption in tailcall with CFI * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92519 - riscv, bpf: Fix memory leak in bpf_jit_free * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92520 - bpf: Zero queue and stack outputs on lock failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89786 - ext4: fix out-of-bounds read in ext4_read_inline_dir() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92521 - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92522 - ACPI: processor: validate MADT IOAPIC entry bounds * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92523 - RDMA/nldev: validate dynamic counter attribute length * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92524 - irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-92525 - RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93037 - RDMA/hfi1: Propagate sdma_txinit_ahg() errors * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93039 - ASoC: meson: Keep link pointers valid on realloc failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93040 - dmaengine: dw-edma: Serialize channel state checks * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93041 - dmaengine: dw-edma: Serialize abort state updates * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93042 - dmaengine: dw-edma: Terminate all descriptors without callbacks * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93045 - bpf: Reject arena frees below the arena base * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93046 - software node: Fix software_node_get_reference_args() with index -1 * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93048 - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93049 - mtd: mtdswap: Avoid freeing registered blktrans device twice * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89777 - vfio/pci: clear vdev->msi_perm after freeing it on init failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93050 - ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93051 - misc: ad525x_dpot: use driver core groups for sysfs files * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93052 - misc: bcm-vk: Use acquire/release for msgq_inited * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93053 - speakup: keyhelp: guard letter_offsets possible out-of-range indexing * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93054 - uio: Fix stale info pointer in failed registration path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93055 - UDF symlink pathComponent header OOB read * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93056 - usb: gadget: f_uac1_legacy: remove broken string configfs attributes * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93058 - drm/msm: Only fini scheduler after successful init * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93059 - drm/msm: Fix task_struct reference leak in recover_worker * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93061 - gpu: host1x: Avoid stack over-read in debug output helpers * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93062 - wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93063 - wifi: iwlwifi: mei: check SAP message length before reading it * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93064 - wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93065 - wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93066 - x86/mm/pat: Take cpa_lock around large-page collapse * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93067 - drm/bridge: tc358767: clamp the reported AUX read size to the request * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93068 - drm/amd/display: Fix DM I2C teardown race * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93070 - media: ipu6: Do not free aux device pdata after init * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93071 - media: bcm2835-unicam: Fix asc leaked in error/remove path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93072 - irqchip/renesas-irqc: Fix generic interrupt chip leak on remove * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93073 - dax: read holder_ops once in dax_holder_notify_failure() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93077 - cxl/features: Clamp Get Feature output size to the remaining buffer * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93078 - cxl/features: Reject Set Features output buffer smaller than the header * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93079 - cxl/features: Reject Get Feature count larger than the output buffer * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93080 - firmware: arm_scmi: Fix transport device teardown lookup * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93082 - firmware: arm_scmi: Unwind P2A receiver mailbox setup failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93083 - firmware: arm_scmi: Unwind TX receiver mailbox setup failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93084 - firmware: arm_scmi: Drop handle on protocol bind failures * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93085 - firmware: arm_scmi: Reject out of range DT protocol IDs * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93086 - firmware: arm_scmi: Avoid IDR updates while cleaning channels * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93089 - firmware: arm_scmi: Free transport channel on IDR failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93090 - firmware: arm_scmi: Clean up channels on setup failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93091 - firmware: arm_scmi: Quiesce notifications before teardown * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93092 - firmware: arm_scmi: Unregister device notifier before IDR teardown * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93093 - firmware: arm_scmi: Publish channel state before callbacks * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93095 - hfsplus: validate thread record before delete key rebuild * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93097 - cxl/mbox: Break poison list loop on an empty payload * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93098 - rpmsg: glink: fix deadlock in endpoint destroy during driver detach * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93100 - fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93101 - media: v4l2-async: Unregister sub-device if asc_list is empty * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89778 - isofs: fix out-of-bounds page array access on empty zisofs block * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93102 - RDMA/hfi1: Free RX data on late probe failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93103 - RDMA/hfi1: Preserve unit 0 on allocation failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-89783 - xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93106 - crash_dump: release keyring reference at the correct time * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93107 - RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93108 - RDMA/ipoib: Drain RCU callbacks during module teardown * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93109 - RDMA/mlx5: Drain RCU callbacks during module teardown * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93110 - RDMA/core: Wait for RCU callbacks before unloading ib_core * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93112 - bpf: Require a BPF cpumask for bpf_cpumask_populate() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93113 - clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93114 - platform/surface: acpi-notify: Check ACPI companion before use * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93115 - platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93117 - usb: fix UAF when probe runs concurrent to dyn ID removal * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93118 - usb: gadget: aspeed_udc: check endpoint DMA allocation * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93119 - usb: ljca: bound bank_num in ljca_enumerate_gpio() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93120 - usb: gadget: configfs: fix out-of-bounds read of qw_sign * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93121 - usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93123 - serial: qcom-geni: do not advance stale DMA completions * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93126 - remoteproc: qcom_q6v5_adsp: Fix reference leak for device node * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93128 - platform/x86: lg-laptop: Fix LED resource handling * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93130 - platform/x86: dell-wmi-base: Fix resource leak on module load failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93131 - platform/x86: dell-privacy: Fix race condition * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93132 - ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93133 - ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93134 - printk: Fix possible console use-after-free * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93136 - bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93137 - bpf: Fix use-after-free on mm_struct in bpf_find_vma() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93138 - bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93140 - udf: Mark LVID buffer as uptodate before marking it dirty * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93141 - usb: gadget: r8a66597: avoid double free of ep0_req in probe error path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93142 - thermal/drivers/rcar: Fix error checking in probe() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93143 - staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93145 - clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93146 - time/namespace: Validate nanosecond field in proc_timens_set_offset() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93149 - wifi: mac80211_hwsim: avoid NULL skb in stop queue drain * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93150 - cgroup/cpuset: Make nr_deadline_tasks an atomic_t * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93151 - nvmet-rdma: fix response resource leak on queue teardown * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93152 - nvme-apple: Use acquire/release for queue enabled state * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93154 - RDMA/irdma: Add refcounting to user ring MRs * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93155 - crypto: keembay - Fix AEAD unregister count in error path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93156 - crypto: rk3288 - fail ahash requests on HASH idle timeout * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93157 - hwrng: xilinx-trng - propagate timeout before any data is read * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93158 - crypto: sa2ul - stop probe if context pool creation fails * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93159 - crypto: atmel-sha204a - fix heap info leak on I2C transfer failure * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93160 - crypto: atmel-ecc - reject hardware ECDH without a public key * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93161 - crypto: qat - clear AES key schedule from stack * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93162 - crypto: qat - cancel work on re-enable SR-IOV timeout * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93163 - hwrng: core - fix rng list on registration error * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93165 - platform/chrome: sensorhub: Fix memory overread in ring handler * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93167 - csky: Fix a4/a5 restoration in syscall trace path * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93169 - dmaengine: zynqmp_dma: fix race between runtime PM and device removal * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93170 - dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93172 - mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93173 - bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93174 - bpf: Copy per-CPU map value padding in copy_map_value_long() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93177 - drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93178 - drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93182 - sched/fair: Fix overflow in update_tg_cfs_runnable() * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93183 - drm/lima: call drm_mm_init() with a valid allocation range * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93184 - ASoC: fsl_audmix: rework runtime PM handling in probe * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93185 - ASoC: rt700-sdw: always drain jack work on remove * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93186 - cxl/mbox: Clamp mailbox output allocation to the payload size * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93188 - HID: roccat: bound device-supplied profile index * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93189 - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93190 - platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93191 - smack: fix incorrect task context in smack_msg_queue_msgrcv * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93192 - drm/v3d: Clear queue->active_job when v3d_fence_create() fails * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93193 - drm/rockchip: analogix_dp: Fix OF node reference leak via auto cleanup * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93194 - drm/rockchip: dw_dp: Release core resources * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93195 - drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93198 - dm-pcache: validate the persisted dirty_tail chain at load * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93200 - i3c: master: Fix use-after-free of master->this * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93199 - i3c: master: Do not treat master device as a duplicate target * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93196 - nvdimm: virtio_pmem: refcount requests for token lifetime * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93202 - i3c: master: Fix recursive locking during device registration * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93203 - batman-adv: bla: avoid CRC corruption due to parallel claim add * Resolute update: upstream stable patchset 2026-10-05 (LP: #2169638) // CVE-2026-93204 - batman-adv: dat: atomically update mac addresses linux (7.0.0-39.39) resolute; urgency=medium * resolute/linux: 7.0.0-39.39 -proposed tracker (LP: #2168074) * Include v4l2loopback in default modules set for 26.04 (LP: #2168012) - [Packaging] Add dependency for v4l2loopback * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) - fsnotify: inotify: pass mark connector to fsnotify_recalc_mask() - clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset - usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() - usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails - usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling - usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x - thermal/drivers/imx: Disable clock on runtime resume failure - thermal/drivers/qoriq: Disable clock on resume failure - userfaultfd: reset err to be 0 when move_pages_ptes succeeded - soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmware size - spi: bcm63xx-hsspi: disable clocks on resume failure - spi: bcm63xx: disable clock on resume failure - spi: bcmbca-hsspi: disable clocks on resume failure - mm/damon/vaddr-kunit: check region count in three_regions test - samples/damon/mtier: handle damon_start() failure - samples/damon/prcl: handle damon_start() failure - samples/damon/prcl: stop and free damon ctx when damon_call() fails - samples/damon/wsse: stop and free damon ctx when damon_call() fails - mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs - mm/damon/sysfs-schemes: kobject_del() scheme dirs - mm/damon/sysfs-schemes: kobject_del() scheme filter dirs - mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs - mm/damon/sysfs-schemes: kobject_del() scheme region dirs - mm/damon/sysfs: kobject_del() region and target (error) dirs - mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs - mm/damon/core-kunit: check region count before testing in split_at() - ftrace: Synchronize the initialization of ftrace_ops - dmaengine: dw-edma: Fix HDMA channel status register access - dmaengine: dw-edma: Complete descriptors before pausing - cpuidle: psci: Fix support for probe deferral by dropping the faux device - block: flag zoned disks with GENHD_FL_NO_PART - ata: ahci: work around lost interrupts on Marvell 88SE61xx - irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout - Input: aiptek - validate raw macro indices before updating state - memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done - memcg: make the v1 soft limit knob inert - rtc: rzn1: Handle EPROBE_DEFER for optional pps interrupt - rtc: rzn1: Fix weekday underflow when alarm crosses month boundary - rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm - rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers - perf trace: Factor out BPF loop body - perf trace: Refactor augmented_raw_syscalls using bpf_for - perf hisi-ptt: Fix PTT trace TLP header parsing - i2c: designware: Enable interrupt mask workaround for HJMC3001 - i2c: qcom-geni: update frequency table to fix timing parameters - arm64: mm: Fix the lockless page-table walk in show_pte() - arm64: errata: pass REVIDR when matching target implementation CPUs - ALSA: rawmidi: Return the error from snd_rawmidi_input_params() - pmdomain: airoha: fix unselectable AIROHA_CPU_PM_DOMAIN kconfig - Revert "irqchip/mbigen: Fix mbigen node address layout" - mm/hugetlb: fix missing migratable flag on same-node hugetlb migration - mm/hugetlb: keep max_huge_pages when dissolving surplus folios - mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON() - parisc: Fix alignment of asm statements in head.S - powerpc/pseries: Handle and log pseries-wdt registration failures - powerpc/pseries: Move H_WATCHDOG definitions to a common header - powerpc/crash: stop watchdogs before booting kdump kernel - s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove - s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap - s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object - mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE() - batman-adv: mcast: ensure unshared skb for multicast packets - batman-adv: bla: prevent CRC corruptions after claim flush - clk: clocking-wizard: fix integer overflow in rate calculation - clk: mediatek: mt8196: Select REGMAP_MMIO for vlpckgen - clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk - clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk - clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src - clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src - clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src - clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk - clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk - clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks - i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure - ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure - ASoC: fsl_easrc: Use div64_u64 for 64-by-64 division - AsoC: intel: sst: fix PCI device reference leak on probe failure - ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get - iio: adc: adi-axi-adc: add data size support for AD408X backend - iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig - iio: adc: pac1921: fix wrong channel used in trigger handler read - iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show - iio: gyro: mpu3050: fix sign of raw angular velocity readings - iio: light: cm32181: return zero after writing calibscale - iio: light: gp2ap002: Disable regulators on resume failure - iio: pressure: mpl115: Fix runtime PM cleanup - iio: srf04: fix pm_runtime handling on probe error path - iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() - iio: ti-ads7138: Disable STATS_EN bit while reading conversion results - iio: light: opt4060: Reject integration times with a non-zero seconds part - iio: light: opt4060: Fix incorrect register name in threshold read error message - iio: light: opt4001: Fix power down clearing bits of the wrong register - iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() - iio: light: opt4001: Reject integration times with a non-zero seconds part - iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask - KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode - KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 - KVM: x86/mmu: Fold kvm_mmu_zap_memslot() into kvm_arch_flush_shadow_memslot() - KVM: x86/mmu: Split kvm_mmu_zap_all_fast() into "front" and "back" halves - KVM: x86/mmu: Use CMPXCHG when clearing Accessed bit in TDP MMU - KVM: x86/mmu: Use split "zap all fast" helpers when invalidating memslot - KVM: x86: Serialize writes to disabled_quirks using kvm->lock - KVM: x86: Ensure runtime reads of disabled_quirks are resolved once - KVM: s390: Zero initialize irq in reinject_machine_check - KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP - KVM: s390: Restore sigset on error path - KVM: arm64: Consider SCTLR_EL2.M when mapping the L1 VNCR page - KVM: arm64: vgic: Fix detection of MI on no pending LR - KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure - LoongArch: KVM: Fix PC double advance in kernel MMIO read fast path - LoongArch: KVM: Fix TOCTOU race on pv_features - LoongArch: Add DIRECT_MAP_PHYSMEM_END definition - LoongArch: BPF: Optimize redundant TCC loads in epilogue - LoongArch: Do not select HAVE_RUST when KASAN is enabled - rust: drm: ioctl: fix unbounded lifetimes in ioctl handler arguments - media: amphion: Remove obsolete frame_count check in venc_start_session - media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash - media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure - media: i2c: imx415: Return test pattern write errors - media: imx355: Avoid calling imx355_power_off twice in error path - media: iris: Enumerate cap->bus_info to differentiate between encoder and decoder - media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common - media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing - media: nxp: imx8-isi: Correct color map between V4L2 and ISI - media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks - media: rkvdec: Propagate platform_get_irq() errors - media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement - media: v4l2-ctrls: Allow unknown HDR10 white point and luminance - media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() - media: venus: fix payload size calculation in parse_raw_formats() - media: vimc: fix pixel format lookup in enum_framesizes - media: qcom: iris: fix state-change debug log printing stale value - media: chips-media: wave5: Guard bit depth check with initial_info_obtained - media: chips-media: wave5: Set inst->std during default format initialization - scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters - scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() - scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() - scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort - scsi: qla2xxx: Drop vport reference under lock in report ID acquisition - scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics - f2fs: return symlink writeback errors - f2fs: reject overlapping move range after len expansion - f2fs: fix to avoid move_range and defragment on device_alias file - f2fs: dirty directory inodes on mtime/ctime update - f2fs: return writeback error from collapse range - f2fs: fix to avoid potential section-unaligned pinfile - f2fs: fix i_size when pinned fallocate partially fails - f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page() - f2fs: fix to zero post-EOF data when extending file size - drm/xe/vram: report FLAT_CCS base misalignment - drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure - drm/ssd130x: fix column and row end address in partial updates for ssd132x - drm/sun4i: fix refcount leak in sun4i_backend_init_sat() - drm/ssd130x: fix column and row end address in partial updates in ssd133x - drm/nouveau/disp/r535: Add scanline position support + head state support - drm/hibmc: Fix list of formats on the primary plane - drm/hibmc: Use drm_atomic_helper_check_plane_state() - drm/gud: validate TV mode names before creating enum property - drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value - drm/amdgpu: check thunderbolt before switcheroo registration - drm/amdgpu: Disable runtime PM for externally attached dGPUs - drm/amdgpu: fix autosuspend cleanup during removal - drm/amdgpu: Skip accessing psp rum time db for APUs - drm/amdgpu: update the fw version for gfx11 userqueues - drm/amdgpu: update the fw version for gfx12 userqueues - drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT - drm/amdkfd: Reject zero-sized AQL queue allocations after size halving - drm/sysfb: simpledrm: Improve framebuffer-size validation - drm/sysfb: simpledrm: Improve panel-size validation - drm/sysfb: simpledrm: Improve stride validation - drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug - drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware - drm/nouveau: Use write-combined maps for coherent - drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c - drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp - drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks - drm/nouveau/disp: fix HDMI vendor infoframes on GB20x - drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x - drm/nouveau/disp: fix head state readback on GB20x - drm/nouveau/gsp: fix vblank interrupts on GB20x - fuse: split off fuse_args and related definitions into a separate header - fuse: remove fm arg of args->end callback - crypto: atmel-ecc - replace min_t with min - mm/hugetlb: defer vmemmap population for bootmem hugepages - mm/hugetlb: refactor code around vmemmap_walk - HID: sony: use guard() and scoped_guard() - ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+ - ACPI: x86: cmos_rtc: Create a CMOS RTC platform device - ACPI: TAD: Rearrange RT data validation checking - ACPI: TAD: Add locking around AML evaluations - bpf: Factor stackid_init function from __bpf_get_stackid - bpf: Factor stackid_fastpath function from __bpf_get_stackid - bpf: Factor stackid_new_bucket from __bpf_get_stackid - bpf: Use stack id functions instead of __bpf_get_stackid - sched: Add assert_balance_callbacks_empty helper - sched: Rework prev_balance() to avoid stale prev references - remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check - NFSD: Consolidate the revocation-path client unpin - mm: rework compound_head() for power-of-2 sizeof(struct page) - hugetlb: remove VMEMMAP_SYNCHRONIZE_RCU - Docs/ABI/damon: fix typo in intervals_goal sysfs path - power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() - mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() - mm/damon/vaddr: drop last same folio access check optimization - mm/damon/paddr: drop last same folio access check reuse optimization - mm/damon/ops-common: use nr_accesses moving sum for quota score - mm/damon/core: skip aging from repeated aggressive merging - mm/damon/sysfs: read addr_unit only once in damon_sysfs_apply_inputs() - mm/damon/core-kunit: handle region split failure in filter_out() - mm/damon/core: initialize damos->last_applied - mm/hugetlb_vmemmap: fix incorrect vmemmap restore in rollback - zram: move lockmap to be per-zram instead per table - ACPI: battery: Use kstrtoul() over sscanf("%lu\n") - ACPI: battery: Protect all properties with a separated mutex - NFSD: Annotate caller preconditions for the state-table walkers - usb: cdnsp: fix wakeup from S3 after controller context loss - usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES - tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member - tracing: Remove the backup instance automatically after read - soc: fsl: qe: Add chained_irq_{enter,exit}() calls in cascade handler - mm/damon/sysfs: read ops_id only once in damon_sysfs_apply_inputs() - mm/damon/core-kunit: skip wrong dest walk in commit_dests_for() - mm/damon/core-kunit: skip wrong quota goal walk in commit_quota_goals() - mm/damon/core-kunit: skip wrong region walk in commit_target_regions() - mm/secretmem: properly account locked pages - futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling - bpf, riscv: Make arena support depend on ZACAS - misc: fastrpc: don't publish fd before copy_to_user() succeeds - perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities - perf build: Add clang and rust target flags for LoongArch - perf/core: Fix deadlock in perf_mmap() failure path - i2c: qcom-cci: Do not check return value of cci_init() - i2c: qcom-cci: Remove overcautious disable_irq() calls - i2c: qcom-cci: fix autosuspend cleanup - ring-buffer: Show persistent buffer dropped events in trace_pipe file - ring-buffer: Allow splice reads on static buffers - dma-buf: add dma_fence_was_initialized function v2 - nvme: fold nvme_config_discard() into nvme_update_disk_info() - Revert "once: don't use a work queue to reset sleepable static key" - mm: fix incorrect vm_flags usage when checking allowable orders for tmpfs - mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses - mtd: rawnand: sunxi: group controller delay tables - mtd: rawnand: sunxi: describe tADL and tWHR delays - mtd: rawnand: sunxi: fix H6/H616 controller timings - batman-adv: fix TX priority extraction for BATADV_FORW_MCAST - clk: microchip: mpfs: fix regmap_update_bits() mask/val order - ASoC: adau1761: sort the register default table - ASoC: cx2072x: sort the register default table - ASoC: fsl_easrc: sort the register default table - ASoC: max9860: sort the register default table - ASoC: ml26124: sort the register default table - ASoC: pcm512x: sort the register default table - ASoC: pm4125-sdw: sort the register default table - ASoC: rt1017-sdca-sdw: sort the register default table - ASoC: rt1316-sdw: sort the register default table - ASoC: rt1318-sdw: sort the register default table - ASoC: rt1318: sort the register default table - ASoC: rt274: sort the register default table - ASoC: rt286: sort the register default table - ASoC: rt298: sort the register default table - ASoC: rt700: drop duplicate reg_default entry - ASoC: rt700: sort the register default table - ASoC: rt711-sdca: sort the register default tables - ASoC: rt711: sort the register default table - ASoC: rt712-sdca-dmic: sort the register default table - ASoC: rt712-sdca-sdw: sort the register default table - ASoC: rt715-sdca: drop duplicate reg_default entries - ASoC: rt715-sdca: sort the register default tables - ASoC: rt715: sort the register default table - ASoC: rt721-sdca-sdw: sort the register default table - ASoC: sgtl5000: sort the register default table - ASoC: sti-sas: sort the register default table - ASoC: tas2552: sort the register default table - ASoC: tas2764: sort the register default table - ASoC: tas2780: sort the register default table - ASoC: tas2783-sdw: drop duplicate reg_default entry - ASoC: tas2783-sdw: sort the register default table - iio: adc: ad4080: configure backend data size - iio: adc: max14001: add missing 'select REGMAP' to Kconfig - iio: dac: ad5446: fix OF module device table - iio: dac: mcp47feb02: add missing 'select REGMAP_I2C' to Kconfig - KVM: x86: Move some EFER bits enablement to common code - KVM: x86: Move enabling EFER.SVME and EFER.LMSLE to generic EFER setup - KVM: arm64: nv: Fully update VNCR fixmap state in kvm_translate_vncr() - LoongArch: Expand module virtual address space to 2GB - LoongArch: BPF: Fix off-by-one error for insn_is_cast_user() - media: dt-bindings: nxp,imx8-isi: Drop fsl,blk-ctrl requirement for i.MX8ULP - media: i2c: vd55g1: Fix manual digital gain on color variant - media: i2c: vd55g1: Fix media bus code initialization - media: mali-c55: fix dropped last AEC histogram zone weight - media: mali-c55: Fix clock leak on reset deassert failure - media: mali-c55: Fix AEXP IHIST disable bit shift - media: mali-c55: Fix scaler factor overflow for large crop sizes - media: rkvdec: hevc: tighten EXT SPS RPS control dimensions - media: chips-media: wave5: avoid skipping device_run while VPU has work - media: chips-media: wave5: Fix pipeline stall when queuing fails - f2fs: embed f2fs_gc_kthread in f2fs_sb_info - f2fs: fix to return -EFSCORRUPTED in f2fs_get_node_info() correctly - f2fs: fix to reclaim space in f2fs_allocate_pinning_section() - drm/i915/display: Clear SEL_FETCH_PLANE_CTL on plane disable - drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE - drm/amd/display: Set gpuvm min page size to 4K on dcn35/36 - drm/nouveau/dmem: fix callocated underflow on large folio split - PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value - Upstream stable to v6.18.51, v7.2.5 * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89795 - PCI: Allow per function PCI slots to fix slot reset on s390 * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89796 - mm/damon/core: avoid infinite kdamond_merge_regions() internal loop * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89804 - drm/nouveau/dmem: fix mismatched DMA unmap size for large folios * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89809 - drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89812 - drm/amdgpu: force complete the MES ring fences on reset * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89813 - drm/amdgpu: force complete the KIQ ring fences on reset * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89815 - drm/ttm: Drop tt->restore after successful restore * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89827 - drm/amdgpu: avoid force-completing uninitialized UVD rings * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89831 - f2fs: protect critical_task_priority updates with s_umount * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89836 - f2fs: fix folio_nr_pages() race after put in large folio invalidate * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89838 - f2fs: limit recovery filename logging to stored length * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89840 - f2fs: validate MOVE_RANGE destination size * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89859 - scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89862 - scsi: qla2xxx: Fix BSG job leak on validate flash image error path * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89866 - media: chips-media: wave5: Resume device before setting EOS flag * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89867 - media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89868 - media: chips-media: wave5: Add timeout while stop_streaming * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89873 - media: v4l2-ctrls: validate HEVC EXT SPS RPS counts * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89875 - media: ti: vpe: quiesce overflow recovery before freeing streams * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89882 - media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89905 - LoongArch: BPF: Move arena register slot below TCC context * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89915 - KVM: arm64: Remove VM-wide VNCR mapping counter * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89917 - KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89919 - KVM: s390: keyop: use mmu_lock to read gmap->asce * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89921 - KVM: s390: Zero initialize data structures for inject_pfault_token * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89935 - iio: light: apds9306: fix PM reference leak in apds9306_read_data() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89966 - mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89967 - mm/migrate_device: avoid out-of-bounds writes for compound folios * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89971 - nvme: skip the zoned limits update if the zone info query failed * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89976 - accel/ethosu: fix job completion fence cleanup * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89977 - accel/ethosu: check MMIO mapping errors in probe * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89978 - accel/amdxdna: return early from a zero-length flush * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89981 - arm64: Don't read GMID_EL1 when MTE is disabled * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89791 - perf: Fix use-after-free when perf mmap() revival races with the last munmap() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89987 - mm/huge_memory: transfer the pmd dirty bit to the folio on zap * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89996 - dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90002 - ftrace: Take trace_array reference before accessing its ftrace_ops * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90013 - tracing: Take trace_array reference when opening options file * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90014 - tracing: Have show_event_filters/triggers files take trace array ref * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90016 - staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90023 - usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90028 - usb: typec: hd3ss3220: track VBUS enable state per consumer * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90040 - KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90043 - zram: fix slot lock bit position on big-endian 64-bit * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89794 - ksmbd: zero pipe read compound padding * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89797 - power: supply: ab8500_fg: fix use-after-free on remove * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90037 - NFSD: Prevent client use-after-free during close_lru reaping * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90036 - NFSD: Prevent client use-after-free during blocked-lock reaping * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89520 - sched/core: Make core-sched flips wait for in-flight selections * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89798 - rpcrdma: arm rn_done before publishing the notification * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89799 - bpf: Disable preemption in bpf_get_stackid * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90041 - HID: sony: clean up device list on probe failure * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90042 - ceph: properly decrypt filenames in vmalloc() buffers * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90039 - NFSD: Guard admin state-revocation walks with NFSD_NET_UP * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90044 - usb: gadget: f_fs: Fix Use-After-Free in AIO error path * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90045 - USB: gadget: ffs: fix mm lifetime handling * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90046 - mm/page_alloc: don't spin_trylock() in NMI on UP * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-80926 - ksmbd: fix use-after-free in oplock break notification * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89800 - drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89801 - drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89802 - drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89803 - drm/nouveau: unsubscribe the channel-kill event before the fence context * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89806 - drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89807 - drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89808 - drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89810 - drm/amdkfd: Fix error path at svm_migrate_copy_to_ram * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89811 - drm/amdkfd: Add TLB flush after MES queue eviction/suspension * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89814 - drm/amdgpu: clamp the isolation index for rings outside a partition * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89816 - drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89817 - drm/gud: NUL-terminate TV mode names read from the device * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89818 - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89819 - drm/amd/display: validate plane degamma LUT size for private color prop * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89820 - drm/amd/display: fix dc_lock leak on GPU reset error paths * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89821 - drm/amd/display: avoid divide-by-zero in __is_lut_linear() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89822 - drm/i915: Guard against NULL driver_data in i915_pci_probe() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89823 - drm: fix race between partial drm_dev_register() failure and ioctl * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89824 - drm/panel-edp: fix i2c adapter leak on probe failure * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89825 - drm/panthor: fix firmware control interface bounds checks * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89826 - drm/panthor: harden firmware build-info bounds checks * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89828 - drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89829 - f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89830 - f2fs: fix valid block count leak on data block allocation failure * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89832 - f2fs: fix to clear dirty flag on folio in error path * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89833 - f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89834 - f2fs: fix to migrate all curseg types during free_segment_range * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89835 - f2fs: avoid NULL checkpoint thread access in sysfs * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89837 - f2fs: fix dentry folio leak in find_in_level * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89839 - f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89841 - f2fs: only redirty pinned folios in redirty_blocks * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89842 - scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89843 - scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89844 - scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89845 - scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89846 - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89847 - scsi: qla2xxx: Avoid double completion in async IOCB timeout * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89848 - scsi: qla2xxx: Quiesce response IRQ before freeing request queue * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89849 - scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89850 - scsi: qla2xxx: Don't query firmware state while chip is down * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89851 - scsi: qla2xxx: Fix FCE trace enable parsing in debugfs * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89852 - scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89853 - scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89854 - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89855 - scsi: qla2xxx: Serialize flash version read in reset handler * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89856 - scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89857 - scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89858 - scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89860 - scsi: qla2xxx: Initialize NVMe abort_work once at submission * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89861 - scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89863 - scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89864 - scsi: qla2xxx: Bound i2c->length in I2C bsg handlers * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89865 - scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89869 - media: qcom: iris: use disable_irq() during power-off * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89870 - media: zoran: Avoid freeing a registered video_device twice * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89871 - media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89872 - media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89874 - media: v4l2-async: avoid deleting unlinked ASC entry on link error * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89876 - media: tda18250: fix possible integer overflow * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89877 - media: saa7164: fix cleanup on resource allocation failure * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89878 - media: s2255: check firmware size before reading trailing marker * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89879 - media: s2255: bound JPEG frame size before copying into the buffer * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89880 - media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89881 - media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89883 - media: rc: sunxi-cir: Unregister rc device on probe failure * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89884 - media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89885 - media: platform: mtk-mdp3: Fix SCP device refcounting * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89886 - media: intel/ipu6: fix async notifier cleanup leak on parse error * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89887 - media: i2c: ov7740: fix use-after-destroy in remove * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89888 - media: i2c: ov02a10: fix endpoint parsing use-after-free * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89889 - media: i2c: imx415: Release runtime PM reference on VBLANK error * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89890 - media: go7007: defer the ALSA v4l2 put until card release * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89891 - media: em28xx: fix use-after-free of dev_next->devlist on disconnect * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89892 - media: em28xx: defer audio-only extension registration * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89893 - media: cx23885: cancel NetUP CI work before teardown * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89894 - media: cx231xx: reject geometry changes while the VBI queue is busy * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89895 - media: cobalt: Avoid freeing ALSA private data twice * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89896 - media: cedrus: fix memory leak in cedrus_init_ctrls() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89897 - media: cec: Serialize exclusive follower delivery * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89898 - media: cec: extron-da-hd-4k-plus: add sanity check * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89899 - media: cec: disable delayed work before freeing an interrupted transmit * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89901 - media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89902 - LoongArch: Avoid preempt count underflow without probe * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89903 - LoongArch: Do not save/restore percpu base register in rethook trampoline * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89904 - LoongArch: Fix acpi_package_ids[] array overflow * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89906 - LoongArch: BPF: Refactor jump offset calculation in tail call * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89908 - LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89909 - LoongArch: KVM: Free init resources if kvm_init() fails * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89911 - KVM: arm64: Correctly cap TLBI Range to the architural limit * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89912 - KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89913 - KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89914 - KVM: arm64: Sign-extend VA for range-based TLBI invalidation * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89916 - KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89918 - KVM: arm64: Correctly handle end of VA space TLBI invalidation * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89775 - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89920 - KVM: s390: Fix memory corruption by not reinjecting CK machine checks * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89922 - KVM: s390: Take srcu when importing watchpoint data * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89923 - KVM: s390: Free guest debug data on vcpu destroy * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89924 - KVM: s390: Fix old_data leak in guest debug error path * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89925 - KVM: s390: Fix memory leak in guest debug handling * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89926 - KVM: s390: Fix length check __import_wp_info() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89927 - KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89928 - KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89929 - KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89930 - KVM: nVMX: Service local TLB flushes on failed nested VM-Enter * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89931 - KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89932 - KVM: nVMX: Always flush vpid02 on first use * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89933 - iio: pressure: dps310: fix NULL pointer dereference on ACPI probe * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89934 - iio: light: ltrf216a: fix runtime PM reference leak in error path * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89936 - iio: dac: m62332: Fix regulator reference count imbalance * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89937 - iio: chemical: sgp30: Handle IAQ thread creation failure * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89938 - iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89939 - iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89940 - iio: buffer: Tie IIO dma fence lock lifetime to the fence * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89941 - iio: buffer: Make IIO DMA fence release RCU-safe * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89942 - iio: buffer: Fix potential use-after-free in anonymous buffer release * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89943 - ASoC: loongson: Fix error handling in ACPI property parsing * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89944 - ASoC: hdac_hda: Fix hlink refcount leak on component registration failure * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89945 - ASoC: cs35l34: drain threaded IRQ before runtime suspend * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89946 - ASoC: cs35l33: drain threaded IRQ before runtime suspend * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89947 - clk: meson: align gxbb_32k_clk_sel number of parents with actual count * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89948 - batman-adv: bla: fix freeing of claims on meshif deletion * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89949 - batman-adv: dat: avoid unaligned fault in IP extraction * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89950 - batman-adv: mcast: linearize skbuff for packet generation * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89951 - batman-adv: fix stale receive device on merged fragments * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89952 - mtd: rawnand: validate ONFI extended parameter page sections * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89953 - mtd: mtdoops: free page bitmap when the backing MTD is removed * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89954 - mtd: afs: validate v2 image info bounds * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89955 - s390/vfio-ap: Fix NULL deref in status_show() during queue probe * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89956 - s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89957 - s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89958 - s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89959 - s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89960 - s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89961 - powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89962 - powerpc/kexec_file: Prevent kexec range truncation * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89963 - powerpc/kexec_file: Fix null-ptr-def in extra size calculation * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89964 - parisc: eisa: Fix infinite loop when parsing invalid IRQ value * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89965 - nvdimm/btt: reject an arena whose nfree is below the lane count * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89968 - nvmet-tcp: reject unsolicited H2CData PDUs * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89969 - nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89970 - nvmet-auth: Synchronize timeout work during SQ teardown * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89972 - nvme: add missing SRCU grace period in error path * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89973 - nvme-tcp: check the data direction of a C2HData PDU * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89974 - nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89975 - nvme-fabrics: fix DHCHAP secret leak on parse failure * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89979 - ALSA: pcm: Fix race between non-atomic ops and trigger-start * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89980 - ALSA: harmony: initialize locks before requesting IRQ * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89982 - i2c: mux: Fix channel node leak on adapter add failure * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89983 - i2c: core: fix debugfs UAF on adapter removal * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89984 - perf/x86/intel: Fix kernel address leakages in LBR stack * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90048 - fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89986 - mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89988 - kprobes: Protect kprobe_blacklist with RCU * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89989 - ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89990 - ceph: lock mutex in ceph_mds_check_access() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89991 - bpf: Fix infinite loop in pcpu_freelist push with one possible CPU * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89992 - cpuidle: dt_idle_genpd: kfree() the original name allocation * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89993 - dmaengine: dw-edma: Initialize IRQ data before requesting IRQs * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89994 - dmaengine: fsl-edma: tracing: no ptr dereference during log output * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89995 - dma-direct: return struct page from dma_direct_alloc_from_pool() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89997 - dm: fix resume-vs-remove race * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89998 - dm: fix race when loading and unloading a table * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89999 - HID: wacom: validate report length in wacom_intuos_pro2_bt_irq * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90000 - HID: rmi: fix OOB access with undersized RMI reports * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90001 - HID: bpf: serialize device reference release in struct_ops destroy path * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90003 - futex: Prevent rcuwait use-after-free during requeue PI * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90005 - samples/damon/wsse: handle damon_start() failure * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90006 - samples/damon/mtier: handle damon_stop() failure * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90007 - scsi: pm8001: Use rollback index when freeing MSI-X vectors * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90011 - scsi: target: iscsi: Reserve a terminator byte for the login payload * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90012 - spi: Fix DMA mapping ownership on partial map failure * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-89793 - ublk: clear VM_MAYWRITE on read-only ublk char device mmap * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90015 - xhci: fix lost bounce buffers on TDs spanning several ring segments * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90017 - staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90018 - staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90019 - usb: gadget: fix null pointer dereference in usb_put_function_instance() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90020 - USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90021 - usb: gadget: f_midi: initialize work in f_midi_alloc() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90022 - usb: gadget: f_midi2: fix use-after-free in string attribute show path * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90024 - usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90025 - usb: typec: ucsi: displayport: Fix OOB altmode array index * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90026 - usb: typec: qcom-pmic: cancel reset_work on stop * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90027 - usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90029 - usb: storage: realtek_cr: fix use-after-free on disconnect * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90030 - usb: dwc3: clear forceRM when issuing EndTransfer * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90031 - usb-storage: ene_ub6250: fix race between scan work and probe * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90032 - media: usbtv: keep device alive while ALSA card exists * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90033 - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90034 - usb: image: mdc800: change kmalloc() to kzalloc() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90035 - drm/amd/display: fix division by zero in get_estimated_bw() * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90047 - drm/xe: Don't hand out the flat CCS storage as usable VRAM * Resolute update: upstream stable patchset 2026-09-22 (LP: #2167950) // CVE-2026-90049 - net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() * Resolute update: upstream stable patchset 2026-09-17 (LP: #2167609) - [Config] Remove CONFIG_CRYPTO_DEV_SUN8I_CE_PRNG - [Config] Remove CONFIG_CRYPTO_DEV_SUN8I_SS_PRNG - ASoC: tegra210_i2s: sort the register default table - ASoC: tegra210_i2s: sort the Tegra264 register default table - ASoC: tegra210_mixer: sort the register default table - ASoC: tegra: Fix the I2S enable default value - ASoC: tegra: Fix the MIXER enable default value - ASoC: tegra: Sort ADMAIF register defaults - ASoC: tegra: Sort MBDRC register defaults - ring-buffer: Fix subbuf resize race with ring buffer readers - drm/amd/display: hide Apple Studio Display secondary tile - drm/amd/display: Prune per-tile Timing from Apple Studio Display Primary Tile - alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally - rust: time: fix as_micros_ceil() rounding near i64::MAX - alpha: don't leak hardware-fabricated FP exception bits to user space - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path - clocksource/drivers/timer-sun4i: Advertise a real minimum delta - fs: fix user path of nested backing files - ovl: fix double end_creating() on the casefold-mismatch path - pidfd: hold exec_update_lock around namespace ioctl - powerpc/pseries/iommu: switch to Default DMA window during kdump - rust: fmt: fix {:p} printing stack addresses - timers/itimer: Zero-init old itimerval before copy to userspace - objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0 - rust: bug: skip arch-specific asm in `testlib` builds - rust: bug: fix warn_on macro build error on UML - rust: bug: prevent dead_code warning from warn_on!'s flags constant - rust: rust_is_available: warn for `bindgen` < 0.72.1 && libclang >= 22 - rust: kernel: list: fix incorrect pop_back example comment - objtool/rust: add one more `noreturn` Rust function - rust: num: restrict bool conversion to unsigned Bounded - rust: cfi: disable function merging if CFI is enabled - KEYS: trusted: Fix TPM teardown ordering - apparmor: fix cred UAF caused by begin_current_label_crit_section() - apparmor: fix out-of-bounds write when null terminating a label vec - include/linux/list.h: mark list_add and __list_add as __always_inline - mm, swap: ratelimit bad swap entry reports - mm/gup: fix always draining LRU caches in collect_longterm_unpinnable_folios() - mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd - mm/huge_memory: use folio's memcg inside __folio_split() - mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier - mm/hugetlb_vmemmap: fix __hugetlb_vmemmap_optimize_folios() - mm/kmemleak: avoid soft lockup when scanning task stacks - mm/madvise: skip device-private PMDs in cold and pageout walks - mm/mempolicy: skip non-present PMDs when queueing folios - mm/mglru: use the common routine for dirty/writeback reactivation - mm/mglru: fix and remove redundant unevictable folio handling - mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() - mm/migrate: use huge_ptep_get() in remove_migration_pte() - mm/migrate_device: clear stale mapping after freeing swapcache - mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn - mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() - mm/page_vma_mapped: use huge_ptep_get() for hugetlb - mm/pagewalk: fix stale walk->action escaping walk_pmd_range() - mm/rmap: use huge_ptep_get() in try_to_unmap_one() - mm/rmap: use huge_ptep_get() in try_to_migrate_one() - mm/slub: fix missing debugfs entries for caches created before sysfs init - mm/slub: prevent pfmemalloc objects from entering the barn - mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() - mm/zswap: fix global shrinker when memory cgroup is disabled - mm: compaction: support non-movable compaction for pageblock requests - mm: memcg-v1: fix wrong linux-mm list address in deprecation warnings - mm: memcg-v1: fix memsw and TCP failcnt accounting - mm: memcg: stop reclaim when a limit update is superseded - mm: memcontrol: update state_local when flushing NMI stats - mm: mempolicy: fix automatic numa balancing for shmem - mm: page_alloc: __GFP_FS lockdep annotation for direct compaction - mm: page_alloc: move capture_control to the page allocator - mm: page_alloc: fix non-movable reclaim storm in defrag_mode - mm: vmscan: fix node reclaim ignoring swappiness parameter - tools/compiler: match glibc 2.42 definition of __attribute_const__ - x86/locking: Use sfence for wmb() if SSE is available - x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() - x86/tdx: Fix off-by-one in port I/O handling - x86/tdx: Fix zero-extension for 32-bit port I/O - x86/xen: fix init of balloon stats again - hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() - tracing/user_events: Clear copied tracing state before fork duplication - tracing: Fix crash passing ERR_PTR to kthread_stop() - tracing: Fix logged instance name on creation failure - tracing: Fix use-after-free in trace_pipe read on sub-buffer order change - tracing: Fix use-after-free with same-name named triggers - cdx: Fix double free when sysfs file creation fails - debugfs: Fix lockdown check for mmap_prepare - device property: fix infinite loop in fwnode_for_each_child_node() - misc: nsm: bound the device-reported response length - powerpc/powermac: fix OF node refcount - rapidio: mport_cdev: fix use-after-free in dma_req_free() - Revert "media: v4l2-dev: fix error handling in __video_register_device()" - serial: imx: serialize imx_uart_ports[] lifetime - staging: greybus: hid: fix SET_REPORT return value - usb: dwc2: gadget: Exit partial power down state when changing USB pull- up - usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition - usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed - USB: phy: fsl-usb: fix missing static keywords - usb: typec: hd3ss3220: fix VBUS regulator error message - usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() - usb: typec: thunderbolt: Disable work before freeing tbt on remove - usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion - usb: gadget: u_audio: Fix use-after-free on sound card disconnect - usb: gadget: snps_udc_plat: clean up PHY on probe deferral - usb: gadget: midi2: remove default configfs groups on teardown - usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() - usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() - usb: gadget: f_fs: Prevent deadlock during ep0 read loop - cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read - fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature - i3c: renesas: Fix out-of-bounds access for newdevs mask - KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID - lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() - media: cec: stm32: prevent out-of-bounds write on RX overflow - media: vicodec: fix out-of-bounds write in FWHT encoder - nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation - of: fix out-of-bounds read in of_alias_scan() stem parser - PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() - phy: rockchip-samsung-dcphy: fix out-of-range max_register - ubifs: fix out-of-bounds read in signature length check - zram: fix out-of-bounds access in read_block_state() - zram: fix out-of-bounds access in writeback_store() - zram: set default primary compressor in zram_destroy_comps() - zram: validate deflate params - zsmalloc: account for handle size in class lookup - NFS/localio: fix ref leak on nfs_uuid_add_file failure - NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails - NFSD: check truncate permission under inode lock - NFSD: Encode only the status in NFS-ACL v2 GETACL error replies - NFSD: Fix off-by-one in DRC bucket pruning limit - NFSD: fix up error returned by write_threads() - NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock - NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check - nfsd: guard nfsd_serv deref in nfsd_file_net_dispose - NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path - pNFS: Fix EBUSY check in pnfs_layout_need_return - lockd, nfsd: RCU-protect nlmsvc_ops dispatch - nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown - nfsd: release path refs on follow_down() error - nfsd: Reset write verifier when async COPY writeback fails - nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths - nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types - nfsd: sample writeback error cursor before async COPY loop - nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations - nfsd: size fh_verify server sockaddr slot by xpt_locallen - nfsd: validate nseconds in TIME_DELEG decode paths - nfsd: validate sockaddr length per family in listener_set - nfsd: validate symlink target length in NFSv4 CREATE - nfsd: move struct nfsd_genl_rqstp to nfsctl.c - nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage - nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() - nfsd: add filehandle match check to nfsd4_delegreturn() - nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry - nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref - nfsd: cap decoded POSIX ACL count to bound sort cost - nfsd: check client ownership when cancelling a copy-notify stateid - nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() - nfsd: clear CALLBACK_RUNNING on failed delegation recall queue - nfsd: clear opcnt on compound arg release to prevent OOB read - nfsd: convert nfsd_net boolean flags to unsigned long flags word - nfsd: dedup nfs4_client_to_reclaim inserts - nfsd: defer setting NFSD4_CALLBACK_RUNNING in deleg_reaper - nfsd: defer vfree of compound ops to fix rpc_status UAF - nfsd: don't free session slots that are still in use - nfsd: drop the stateid, not the stateowner, on seqid_op replay retry - nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file - nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke - nfsd: fix clock domain mismatch in clients_still_reclaiming() - nfsd: fix cpntf publish race in nfs4_init_cp_state - nfsd: fix dentry ref leak on V4ROOT export filehandle lookup - nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net - nfsd: fix FL_SLEEP being set unconditionally for all LOCK types - nfsd: fix netlink dumpit error handling for rpc_status_get - nfsd: fix nfsd_file leak on inter-server COPY setup failure - nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs - nfsd: fix partial-write detection in nfsd_direct_write - nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() - nfsd: fix refcount leak in nfsd_file_lru_add on insertion failure - nfsd: fix reply size estimate for GET_DIR_DELEGATION - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY - nfsd: fix UAF in async copy cancel and shutdown - nfsd: fix version mismatch loops in nfsd_acl_init_request() - nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget - nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo - nfsd: gate nfs2 setacl by argp->mask - nfsd: gate nfs3 setacl by argp->mask - nfsd: hold rcu across localio cmpxchg retry - nfsd: initialize copy-notify stateid before publishing it - nfsd: initialize DRC hash table before registering shrinker - nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() - nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache - nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops - nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE - nfsd: reject reclaim LOCK after RECLAIM_COMPLETE - nfsd: release OPEN-decoded posix ACLs via op_release - nfsd: revoke copy-notify stateids before dropping their reference - NFSD: Prevent lock owner use-after-free during client teardown - NFSD: Prevent post-shutdown use-after-free in unlock_filesystem - NFSD: Prevent client use-after-free during admin state revocation - nfsd: convert global state_lock to per-net deleg_lock - NFSD: Prevent client use-after-free during delegation revoke - NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup - nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update - libceph: validate OSD extent maps before cursor advance - libceph: reject buckets with mismatched CRUSH ids - ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock - ceph: fix UAF in check_new_map() on session freed during unlock - ceph: force a cap message when a deferred revoke can't be acked immediately - ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode - ceph: bound copied dentry name length in NFS export get_name - ceph: bound MDSCapAuth path and fs_name decode in handle_session() - ceph: bound num_export_targets array for mds info v2/v3 - ceph: bound xattr value length in __build_xattrs() - ceph: cap delegated inode count in ceph_parse_deleg_inos() - ceph: do not repeat ceph_trim_dentries() if no progress possible - ceph: fix leaked inode reference on writeback abort at umount - btrfs: drop recovered reloc root refs on recovery failure - btrfs: fix extent map leak in NOCOW direct I/O write - btrfs: do not overwrite NODATASUM flag when removing NODATACOW flag - audit: avoid dropping live tree ref on fsnotify rule autoremove - smb: move some definitions from common/smb2pdu.h into common/fscc.h - smb/client: reduce fallocate zero buffer allocation - smb/client: emulate small EOF-extending mode 0 fallocate ranges - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem - smb/client: do not account EOF extension as allocation - cifs: call pagecache_isize_extended() in cifs_setsize() when extending - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions - smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 - smb: client: clear ce->tgthint in free_tgts() - smb: client: fix ALIGN() overflow in symlink_data() error context loop - smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() - smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() - smb: client: harden DFS cache against invalid target hints - smb: client: reject a tree connect response whose byte count is too small - smb: client: restore the data_offset bound in is_valid_oplock_break() - HID: apple: preserve keyboard backlight across T2 resume - HID: corsair-void: Check size of status and firmware events before reading them - HID: picolcd: clamp eeprom debugfs read to bytes actually received - HID: roccat: free buffered reports when destroying device - HID: sensor: custom: Fix field sysfs group cleanup on failure - HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind - HID: universal-pidff: stop the device when force-feedback init fails - HID: mcp2221: stop device IO before hid_hw_stop - HID: mcp2221: fix OOB write in mcp2221_raw_event() - HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes - HID: mcp2221: validate report size in mcp2221_raw_event() - HID: intel-thc-hid: intel-quickspi: validate report size before copy - HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer - HID: intel-thc-hid: intel-quicki2c: fix autosuspend cleanup during teardown - HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown - eventfs: Initialize ei->children and ei->list in init_ei() - fs/ntfs3: validate dirty page table on log replay - fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() - fs/ntfs3: bound page_lcns[] index by the log record - eCryptfs: bound the packet-length peek to the user buffer - ecryptfs: fix tag 11 packet exact-fit size check - ecryptfs: hold msg ctx list lock when cleaning daemon queue - ecryptfs: pass packet set buffer size to parser - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet - ecryptfs: reject too-small tag 70 packets - ecryptfs: release message context on send failure - ecryptfs: show filename encryption options - efivarfs: Rate limit statfs() handler - entry: Fix seccomp bypass after ptrace with TSYNC - erofs: skip sufficiently large global buffers when resizing - ext2: Fix lost inode updates for IS_SYNC inodes - fanotify: fix use-after-free of file range info - fat: restore original value when fat_ent_write failed - fbdev: omapfb: panel-dsi-cm: initialize lock before registering display - fbdev: pvr2fb: correct user pointer annotation and sentinel initializer - fbdev: ssd1307fb: defer I2C transfers from damage callbacks - fbdev: uvesafb: unregister connector callback on init failure - forcedeth: fix off-by-one when saving/restoring non-PCI config space - fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration - fsnotify: Fix stale object mask after concurrent mark updates - hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device - hugetlb: only adjust reservation during unmapping if mapcount is 0 - accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() - accel/rocket: initialize job domain before cleanup paths - accel/rocket: Fix error path handling in rocket_job_run() - acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks - ACPI: APEI: Fix ERST timeout unit conversion - ACPI: APEI: GHES: fix ARM section length accounting after header - ACPI: pfr_update: fix stack buffer overflow in query_capability() - ACPI: scan: Avoid registering platform devices with resource overlaps - alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() - alpha: marvel: Fix irq_set_status_flags to use correct IRQ number - alpha: marvel: Fix lock ordering in init_io7_irqs() - ARM: 9477/1: Disable broken eBPF JIT on the Risc PC - ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes - auxdisplay: charlcd: cancel backlight work on registration failure - backlight: aw99706: Fix DT property names to match binding - backlight: aw99706: Honor the core blank state in update_status() - block: validate user space vectors during extraction - block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() - Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU - Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU - Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 - Bluetooth: eir: Fix OOB read in eir_get_service_data() - bnx2x: fix double free in bnx2x_init_firmware() error path - bnxt_en: Write doorbell when linearizing skb fails - bpf, x86: Fix per-CPU address resolution into an extended register - bpf: Disable preemption in __bpf_get_stack - buffer: avoid tail commit walk for uptodate folios - bpf: Harden bloom filter sizing and indexing on 32-bit kernels - dm-io: clone the source bio instead of copying its biovec - dm-io: report non-retryable errors separatedly - dm-era: fix shadowed superblock leak on take-snap failure - dm raid1: reserve space for NUL-terminator in build_constructor_string() - dm array: validate array block headers on read - dm array: reject an array block whose value size is not the caller's - coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior - cpufreq: apple-soc: Fix OPP table cleanup - cpufreq: schedutil: Fix rate limit overflow - cxl/features: bound fwctl command payload to the input buffer - dax/cxl, hmem: Initialize hmem early and defer dax_cxl binding - cxl/region: Add helper to check Soft Reserved containment by CXL regions - cxl/mce: Make the MCE notifier per-region - cxl/pmem: Format the nvdimm serial number as unsigned decimal - cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register - Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 - Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative - Bluetooth: hci_uart: Fix false success return in hci_uart_setup() - Bluetooth: RFCOMM: serialize security confirmation handling - Bluetooth: hci_conn: re-enable advertising only for peripheral role - Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb - Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection - Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative - Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative - Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request - kasan: fix cache shrink race with CPU hotplug - jbd2: bound shrinker scans by examined checkpoint buffers - jbd2: check need_resched() when skipping busy checkpoint buffers - ipip: fix skb leak in collect_md mode when metadata_dst allocation fails - ip: orphan prefetched skbs before multicast forwarding - ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() - ip6_gre: fix hardware header length for NBMA tunnels - ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() - ipv6: use RCU iterator to dump route exceptions - landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() - mailbox: qcom-ipcc: fix duplicate channel allocation across holes - md/raid10: fix still_degraded being inverted in raid10_sync_request() - md: do overflow check for sb->bblog_shift in super_1_load() - module: validate string table section types - mpls: reload header after pskb_may_pull() - mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction - module/kallsyms: fix nextval for data symbol lookup - nouveau/gem: reserve the bo in the info ioctl around the vma lookup - params: fix charp corruption on allocation failure - phy: fsl-imx8mq-usb: fix typec switch leak on probe error path - SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry - SUNRPC: svcauth_gss: enforce krb5 token minimum length - sunrpc: route to a populated pool in svc_pool_for_cpu() - SUNRPC: Restore NUMA_NO_NODE for svc thread allocations in global mode - SUNRPC: always drain cache_cleaner before destroying a cache_detail - SUNRPC: Check svc pool percpu counter allocation - SUNRPC: close backchannel before destroying callback service - sunrpc: defer rq_argp and rq_resp free until after RCU grace period - SUNRPC: fix gssx_dec_option_array error path bugs - sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir - SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens - SUNRPC: harden gss_unwrap_resp_priv length checks - sunrpc: init gssp_lock before publishing proc entry - SUNRPC: reject duplicate CREDS_VALUE options - SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 - SUNRPC: wait for in-flight client TLS handshake callback - svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id - svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails - svcrdma: Fix offset arithmetic in read_chunk_range - svcrdma: Fix pcl_for_each_segment for empty chunks - svcrdma: Fix unmatched rn_unregister on failed accept - svcrdma: Reject connection when transport allocation fails - svcrdma: Reject inline replies that overflow the pull-up buffer - svcrdma: Reject oversized Read segments at decode time - svcrdma: Reject Read lists that exceed the page budget - svcrdma: Reject Write/Reply chunks with segcount 0 - svcrdma: Use svc_xprt_put to free listener on create failure - svcrdma: Validate Read chunk positions before reconstruction - udf: reject VAT indexes equal to the entry count - wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets - wifi: mt76: mt7925: cancel pending mlo_pm_work - staging: media: tegra-video: fix of_node_put() on VIP parse errors - staging: media: tegra-video: vi: fix probe failure on skipped last port - media: staging/ipu7: fix async notifier UAF on probe error path - sched/core: Handle pick_task() releasing the rq lock - sched_ext: Fix exit_task leak on fork failure during enable - sched_ext: Fix inverted ops.core_sched_before() invocation - sched_ext: Keep kick_sync waiting on the rq's own CPU - scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() - scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock - rpmsg: glink: smem: order FIFO read after availability check - Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinephone Pro" - arm64: dts: qcom: kodiak: avoid EFI overlap for ADSP remote heap - arm64: dts: qcom: sm6115-pro1x: Correct touchscreen GPIO flags - arm64: dts: qcom: x1-dell-thena: mark l12b and l15b always-on - arm64: dts: rockchip: fix eMMC reset polarity on PP-1516 - arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck - arm64: dts: rockchip: fix emmc reset polarity on px30-cobra - arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio - arm64: dts: rockchip: Fix rk3588s-roc-pc audio description - riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage - riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage - RISC-V: KVM: Fix PMU event info array size overflow - riscv: acpi: Handle LPI architectural context loss flags - riscv: unaligned: stop using kthread for check_vector_unaligned_access() - remoteproc: scp: Fix device reference leak on failed lookup - qede: Fix NULL pointer dereference in TPA fragment processing - RDMA/cxgb4: Cancel reg_work before freeing device on remove - RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget - RDMA/ionic: Embed counter driver data in rdma_counter allocation - RDMA/ucma: Lock the handler in ucma_set_ib_path() - RDMA/ucma: Lock the handler in ucma_write_cm_event() - RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer - regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata - regulator: qcom-refgen: correct the regulator type to CURRENT - ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() - ring-buffer: Free cpu_buffer::free_page with subbuf_order - ring-buffer: Hold cpu_buffer::lock when resizing a subbuf - ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page - PM: sleep: Unblock runtime PM when device prepare fails - orangefs: fix double-free of trailer_buf on readdir copy failure - orangefs: skip leading spaces before parsing client debug masks - ocfs2: always run deallocs on copy-on-write completion - ocfs2: bound namelen in dlm_migrate_request_handler - ocfs2: validate lengths in dlm_mig_lockres_handler - ocfs2: validate rl_used against rl_count in refcount block validator - ocfs2: validate dx_root extent list fields during block read - ocfs2: validate directory-index entry counts when reading metadata - ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() - ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item - ocfs2: cluster: fix o2hb_dependent_users leak on pin failure - ocfs2: fix cached cluster count after suballocator reclaim - ocfs2: fix readdir position truncation on 32-bit kernels - openrisc: fix arbitrary kernel memory access via or1k_atomic syscall - openvswitch: Fix CT limit teardown use-after-free - openvswitch: only skb_tx_error() a packet we are about to drop - ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion - arm64: compat: Fix decrementing LDM/STM alignment emulation - arm64: proton-pack: Restore the nospectre_bhb command-line option - ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC - ASoC: codecs: aw88261: reduce log spam - ASoC: codecs: aw88261: only check PLL and clock state at power-up - hwmon: (max6621) fix negative temperature offset and crit readings - hwmon: (max6621) fix temperature clamp range - i2c: mxs: fix DMA channel leak on probe error - ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() - lockd: pin next file across nlm_inspect_file lock-drop - lockd: fix NULL dereference on lockowner allocation failure - lockd: fix swapped arguments in nlmsvc_match_ip() - nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path - nvme: zero the discard fallback page - nvme-pci: disable controller on admin queue IRQ setup failure - nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone - nvme-tcp: fix host memory disclosure on R2T for a read command - nvme-tcp: reject a read that transferred too few bytes - sctp: stop processing a packet once its association is deleted - sctp: drop a chunk if its transport was removed - sctp: fix NULL deref on untransmitted RECONF completion - sctp: distinguish sequence zero from wildcard in reconf lookup - sctp: fix stream->outcnt underflow on duplicate RECONF responses - power: supply: bq24257: fix use-after-free on remove - power: supply: bq256xx: drain usb_work before freeing the charger - power: supply: bq25890: Fix power_supply reference leak - power: supply: charger-manager: register regulators before exposing sysfs - power: supply: cros_usbpd-charger: bound the EC-reported port count - power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS - power: supply: lp8727: fix use-after-free in lp8727_release_irq() - power: supply: lp8788-charger: fix use-after-free on remove - power: supply: pf1550: enable charging when battery profile exists - power: supply: qcom_battmgr: fix use-after-free - power: supply: qcom_battmgr: terminate the strings from firmware - power: supply: rt9455: quiesce delayed work before teardown - power: supply: twl4030_charger: cancel workers via devm - power: supply: ucs1002: fix use-after-free on remove - power: supply: max17040: propagate register read errors - power: supply: max17040: drop incorrect I2C functionality check - power: supply: max17040: synchronize work cancellation on suspend - s390/dasd: Do not complete a failed ESE read as successful - s390/dasd: Guard sysfs discipline callbacks against unallocated private data - s390/dasd: Propagate partial completion length across ERP recovery - PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip - PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk - PCI: meson: Fix GPIO state while requesting PERST# - PCI: starfive: Fix resource leaks on error paths in host_init() - PCI: plda: Fix use-after-free of event IRQs during teardown - PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() - PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] - PCI/sysfs: Fix read byte order in pci_read_legacy_io() - PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses - PCI/AER: Emit TLP Log only for unmasked errors - PCI/AER: Fix mapping of errors to agent & layer - PCI/MSI: Enable memory decoding before restoring MSI-X messages - PCI/proc: Avoid spurious runtime PM wakeup on config space accesses - PCI/proc: Use file_ns_capable() when checking config space read access - PCI/proc: Warn on writes to kernel-exclusive config space regions - iommu/amd: Put PCI device after handling PPR faults - iommu/msm: Unwind probe state on registration failure - iommu/sva: Set handle->dev before the SVA handle is visible - iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field - iommu/arm-smmu-v3: Add HAFT support for SVA - iommu/arm-smmu-v3: Manage teardown with devm - iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add - iommu/vt-d: Fix no_iommu to disable platform opt-in - iommu/vt-d: Force requesting ACS when tboot is enabled - iommupt: Return zero for invalid iova_to_phys() ranges - iommufd: Avoid locking internal accesses during unmap - iommufd: Release current IOAS on xa_store() failure - iommufd: Fix UAF in selftest IOPF reporting - platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer - platform/x86: ISST: Validate level in perf mask ioctls - platform/x86: ISST: Validate socket ID in clos_assoc ioctl - mmc: via-sdmmc: cancel card-detect work on remove - mmc: via-sdmmc: stop card-detect handling on probe failure - platform/x86: ISST: Add a NULL check for sst_inst[] - platform/x86: ISST: Just allow 2 bits for SST feature enable - platform/x86: ISST: Use PP level enable mask - platform/x86: ISST: Validate logical CPU id and clos id - platform/x86: ISST: Validate max level for set feature - platform/x86: ISST: Validate parameter for core power state - platform/x86: ISST: Validate parameter for frequency and priority - platform/x86: ISST: Return error during profile addition - platform/x86: int1092: Fix potential memory leak in sar_probe() - platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path - platform/x86: lenovo/ymc: Only match lower byte in WMI lid switch query response - platform/x86: think-lmi: Fix certificate thumbprint sysfs output - platform/x86: think-lmi: Free system certificate signatures - platform/x86: think-lmi: Fix current password length check - platform/chrome: sensorhub: Bound the EC-reported sensor number - platform/x86/amd/pmc: Restore msg_port on amd_stb_s2d_init() error paths - platform/x86/amd/pmc: Propagate SMU errors and validate S2D address - platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails - platform/x86/amd/pmc: Fix msg_port restoration in amd_stb_debugfs_open_v2() - platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS - platform/x86: hp-bioscfg: advance elem past consumed array elements - platform/x86: hp-bioscfg: bound ordered-list parsing by the package count - platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() - platform/x86: hp-bioscfg: fix heap OOB read on empty password write - platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password - platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() - platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed - platform/x86: hp-bioscfg: pass validated element count to package parsers - platform/x86: hp-bioscfg: warn on element type mismatch instead of failing - io_uring/waitid: honor task_work cancellation - io_uring/waitid: avoid siginfo copy during ring teardown - io_uring/query: cap user size passed to copy_struct_to_user - interconnect: Fix use after free in icc_get() and of_icc_get_by_index() - ipmi: ipmb: validate write message length - ipmi: Remove all sysfs files on registration failure - ipmi: si: Fix NULL pointer dereference after failed registration - ipmi:msghandler: Cancel work cleanly on an error - net/iucv: filter frames in afiucv_hs_rcv() by ingress device - xdp: fix zero-copy frame layout - slip: fix use-after-free in sl_sync() - net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition - net: tun: bound receive headroom - net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO - net: ibm: emac: mal: fix NAPI locking - net: ipa: fix stalled modem TX queue after runtime resume - net: l2tp: do not propagate multicast notification errors - net: openvswitch: fix flow mask use-after-free on flow deletion - net: openvswitch: fix nf_connlabels leak in ovs_ct_init - net: phylink: correctly validate returned PCS in phylink_inband_caps - net: ravb: avoid dereferencing an invalid PTP clock - net: ravb: serialize PTP clock teardown - net: thunderbolt: Release the Rx HopID that was handed out on mismatch - net: thunderbolt: Mark the connection down when bringing it up fails - NTB: ntb_transport: Recycle TX entries before client callbacks - NTB: ntb_transport: Fail TX enqueue when the QP link is down - NTB: ntb_transport: Reject oversized TX buffers - net: ntb_netdev: Fix TX busy and drop handling - net: ntb_netdev: Avoid double-accounting netif_rx() drops - net: ntb_netdev: Count packets dropped on RX refill failure - net/mlx5e: SHAMPO, Always calculate page size - net/mlx5e: do not HW-GRO coalesce small frames - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry - net/smc: do not dereference an unset send buffer on the SMC-D teardown path - net/smc: fix socket refcount leak in smc_switch_conns() - net/smc: fix use-after-free in smc_rx_pipe_buf_release() - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() - net/smc: stop killed, freed and out_of_sync sharing a byte - net/smc: unregister the connection before draining the rx tasklet - net: cap advertised IP tunnel headroom - net: fix spurious TX timeout after dev_activate() - net: skbuff: don't touch shared zerocopy state in skb_tx_error() - seg6: reset IP6CB after IPv6 decapsulation - hwrng: stm32 - Fix runtime PM cleanup on registration failure - mfd: cgbc: Fix teardown ordering in cgbc_remove() - mfd: qnap-mcu: keep the reply buffer alive past a command timeout - mfd: sm501: Fix potential memory leaks during remove - ALSA: 6fire: bound the MIDI event length from the device - ALSA: aloop: Check card index validity at probe - ALSA: bcd2000: clear the URB pointers on disconnect - ALSA: FCP: do not copy out an uninitialised init response - ALSA: hda/ext: preserve PPLCCTL bits when clearing reset - ALSA: mpu401: Check card index validity at probe - ALSA: mts64: Check card index validity at probe - ALSA: pcxhr: initialize mutexes before requesting threaded IRQ - ALSA: portman2x4: Check card index validity at probe - ALSA: serial-u16550: Check card index validity at probe - ALSA: virmidi: Check card index validity at probe - ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx - ALSA: hda/realtek: Enable micmute LED on HP EliteBook 6 G1a p/n: AD3Q9ET#UUG - ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering - arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() - dm-stats: fix a crash if allocation of per-cpu data fails - dm-switch: use WRITE_ONCE() in switch_region_table_write() - dm-pcache: validate geometry fields from on-disk cache_info - dm-pcache: validate kset key_num and intra-segment bounds - dm-pcache: validate on-media seg_num against the cache device size - dm-pcache: bound the persisted tail-position offset - dm-pcache: clamp the tail kset read to the segment data region - dm-pcache: detect a cycle in the last-kset chain during replay - dm-pcache: only hand out initialized cache segments - dm-pcache: fix implicit u8 truncation of gc_percent in message handler - dm-pcache: fix use-after-free and invalid seg operations in kset_replay() - i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() - i3c: master: adi: initialize the lock before enabling interrupts - i3c: master: Fix info leak and UAF in device unregister path - i3c: master: svc: bound IBI payload to the requested max_payload_len - i3c: renesas: Check that the transfer is valid before accessing it - i3c: renesas: Clean DATBAS register on detach - i3c: renesas: Follow the reset deassert order used in probe - i3c: renesas: Reconfigure the DATBAS register on re-attach - i3c: renesas: Reset the controller on resume - i3c: renesas: Restore STDBR and EXTBR registers on resume - i3c: renesas: Perform Dynamic Address Assignment on resume - wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() - wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() - wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop - fuse-uring: refactor io-uring header copying to ring - fuse-uring: refactor io-uring header copying from ring - fuse-uring: use enum types for header copying - fuse-uring: refactor setting up copy state for payload copying - fuse-uring: use named constants for io-uring iovec indices - fuse: copy request headers via a stack buffer for io-uring - crypto: iaa - unmap dst before software fallback on decompress - crypto: atmel-ecc - clean up and improve ECDH comments - crypto: atmel-ecc - avoid stale fallback key after set_secret failure - mm/kmemleak: stop the task stack scan early when interrupted - mm/kmemleak: report RCU-tasks quiescent states during the scan - wifi: mwifiex: Detach sync cmd buffer on interrupted wait - wifi: rtl818x: initialize eeprom_93cx6 struct to zero - wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids - wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() - wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() - wifi: rtw88: pci: fix resource leak on failed NAPI setup - wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot - wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex - wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy - wifi: mt76: mt7925: cancel mlo_pm_work on stop - wifi: mt76: add external EEPROM support for mt799x chipsets - wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy - wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames - wifi: mt76: mt7996: validate default EEPROM firmware size - vsock/virtio: flush works in dependency order - w1: ds28e17: reject an oversize length on an I2C block read - xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() - zloop: truncate finished zones to zone capacity - tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout - sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] - sticon/parisc: Detect default STI graphics card for console output - signal: avoid shared siginfo namespace rewrites - smack: fix cred UAF in smack_file_send_sigiotask() - taskstats: fix cpumask parsing cutting off the last character - timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex() - timer: Keep debugobjects state consistent in migrate_timer_list() - udf: Fix i_lenExtents truncation on 32-bit kernels - selftests/mm: fix on-fault-limit false failure under sudo-rs - resource: Add __resource_contains_unbound() for internal contains checks - ACPI: scan: Do not combine resources that overlap completely - platform/chrome: sensorhub: Fix dropped timestamp events and log spam - Upstream stable to v6.18.49, v6.18.50, v7.2.2, v7.2.3, v7.2.4 * Resolute update: upstream stable patchset 2026-09-17 (LP: #2167609) // CVE-2026-80724 - ptp: vmclock: prevent read-only mappings from becoming writable * Resolute update: upstream stable patchset 2026-09-17 (LP: #2167609) // CVE-2026-80914 - Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready * Resolute update: upstream stable patchset 2026-09-17 (LP: #2167609) // CVE-2026-80833 - crypto: sun8i-ss - Remove crypto_rng interface * Resolute update: upstream stable patchset 2026-09-17 (LP: #2167609) // CVE-2026-80834 - crypto: sun8i-ce - Remove crypto_rng interface * Resolute update: upstream stable patchset 2026-09-17 (LP: #2167609) // CVE-2026-80925 - vlan: fix skb_under_panic and races when toggling HW VLAN offload * Resolute update: upstream stable patchset 2026-09-17 (LP: #2167609) // CVE-2026-80857 - fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free * Resolute update: upstream stable patchset 2026-09-17 (LP: #2167609) // CVE-2026-80858 - fuse: publish io-uring queues with release semantics * Resolute update: upstream stable patchset 2026-09-17 (LP: #2167609) // CVE-2026-80859 - fuse: fix missing barrier when checking io-uring readiness * Resolute update: upstream stable patchset 2026-09-17 (LP: #2167609) // CVE-2026-80860 - fuse: fix race between interrupt and resend * [SRU] Add support for amd-pmf AMDI0112 ID (LP: #2165251) - SAUCE: platform/x86/amd/pmf: Add AMDI0112 ACPI ID * Backport: "mm/gup: fix GUP-fast fallback for NULL-mapping order-0 folios" (LP: #2162917) - mm/gup: fix GUP-fast fallback for NULL-mapping order-0 folios * Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware (LP: #2166944) - Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware * System cannot enter s0ix suspend on Dell with RTL8116AF ethernet (LP: #2160475) - Revert "UBUNTU: SAUCE: r8169: add quirk for RTL8116af SerDes" - SAUCE: r8169: add speed in private struct - SAUCE: net: phy: phylink: add helper to modify pause - SAUCE: r8169: add support for phylink - SAUCE: r8169: add support for RTL8116af - SAUCE: r8169: add support for RTL8127atf - SAUCE: r8169: add ltr support for RTL8117 series - SAUCE: r8169: fix RTL8116af can not enter s0idle and c10 * net:rtnetlink.sh in ubuntu_kselftests_net failed with ipsec_offload on resolute (7.0.0-38.38) generic s390x (LP: #2166631) - SAUCE: Fix selftest/net/rtnetlink.sh for Big Endian * [UBUNTU 24.04] kernel: CPU hotplug unsupported by CPUMF (LP: #2165732) - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks * [Ubuntu 26.04] Failed install OS onto JBOD disk on B540d-2HS M.2 controller (LP: #2148534) - scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame * New 7.0 ubuntu_kselftests_net/net:tun tests flaky (LP: #2158217) - SAUCE: selftests/net: Run tun tests in a dedicated network namespace * ThinkPad X9-15 Gen 1: IPU7 camera probe fails — duplicate software_node SONY471A-0 (-EEXIST), bridge init failed (LP: #2158540) - SAUCE: media: ipu-bridge: drop duplicate IMX471 sensor config * append bpf to CONFIG_LSM (LP: #2166235) - [Config] append bpf to CONFIG_LSM * Add a linux-main-modules dependency toggle to kernel build process (LP: #2166181) - [packaging] Create a linux-main-modules dependency toggle * Resolute update: upstream stable patchset 2026-09-04 (LP: #2166517) - RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp - RDMA/rxe: Fix OOB in free_rd_atomic_resources() - KVM: x86/mmu: Check write tracking in all address spaces - nvme-tcp: fix usage of page_frag_cache - Revert "selinux: reject a permission value exceeding the class permission count" - selinux: use u16 for security classes - selinux: more strict policy parsing - selinux: reject a permission value exceeding the class permission count - selinux: require a class's permission values to cover its permission count - selinux: switch two allocations to use kzalloc_objs() - veth: fix OOB txq access in veth_poll() with asymmetric queue counts - ksmbd: harden file lifetime during session teardown - fpga: dfl: fme: add error handling - accessibility: speakup: unregister tty ldisc on later init failures - usb: xhci: Handle bogus TRB pointers in Missed Service Error events - usb: xhci: Handle USB3 port events when there is one roothub - xhci: dbgtty: Fix unregister on tty_register_driver() failure - xhci: dbgtty: Fix unregister on tty_alloc_driver() failure - fuse: fix invalidate lock leak on setattr writeback failure - fuse: fix invalidate lock leak on open O_TRUNC DAX failure - usb: usbtest: disable dynamic ID support - usb: gadget: f_tcm: keep port count until LUN teardown completes - KVM: SEV: Drop FOLL_WRITE for encrypted region registration - KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests - KVM: SEV: Extract loading of guest-provided VMSA to a separate helper - KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable - KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y - tls: device: fix out-of-bounds write in tls_append_frag() - gtp: serialize PDP context updates - x86/CPU/AMD: Carve out a Zen5 models range - net/tcp: fix TCP-AO key deletion in VRFs - tcp: fix AO info use-after-free in tcp_ao_connect_init() - net/tcp-ao: fix use-after-free of current_key on reconnect to another peer - xfrm: espintcp: fix UAF during close - xfrm: drop ESP-in-TCP packets with no ingress device - xfrm: avoid lock inversion in nat keepalive work - xfrm: ah6: validate routing header segments_left - xfrm: fix xfrm_state_construct() auth-trunc leak - xfrm: bound nat keepalive state collection - net: bridge: mcast: fix use-after-free of a master VLAN's multicast context - ipv6: seg6: clear IPv4 control block on IPIP decapsulation - batman-adv: reject unrepresentable multicast TVLV offsets - vxlan: keep the last remote linked during FDB flush - netfilter: nft_set_pipapo_avx2: add missing vzeroupper - netfilter: nf_tables: don't queue packet path object notifications - mm/swap: reject swapon() on filesystem-level encrypted files - kunit: irq: Continue increasing hrtimer interval for longer - crypto: virtio - bound the akcipher result length - crypto: qcom-rng - Enable clock in hwrng case - crypto: qcom-rng - Remove crypto_rng interface - crypto: qcom-rng - Allow zero as a random number - crypto: atmel-tdes - use scatterlist length before DMA mapping - crypto: krb5 - use kfree_sensitive() for derived key buffers - crypto: qce - fix CCM AAD buffer underallocation - crypto: mxs-dcp - fix source scatterlist length access - crypto: qce - Remove unsafe/deprecated algorithms - KVM: s390: vsie: zero stale crypto bits - usb: core: Add lock to usb_wakeup_notification() - usb: core: Strengthen error handling in hub_hub_status() - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() - ALSA: usb-audio: Complete cleanup after system-resume errors - USB: serial: option: fix slab OOB read in interrupt URB callback - USB: serial: spcp8x5: drop broken carrier detect support - USB: c67x00: fix use-after-free in c67x00_add_iso_urb() - wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb - usb: usbfs: fix use-after-free of usb_device in usbdev_release() - usb: xhci: bail out of setup if the controller is inaccessible - net: advertise TCP MSS from the configured MTU, not the learned PMTU - tcp: clamp route advmss to TCP_MIN_MSS - net/packet: defer vmalloc TX_RING free until skbs finish - crypto: iaa - fall back to software for multi-entry scatterlists - Upstream stable to v6.18.49, v7.1.13 * Resolute update: upstream stable patchset 2026-09-03 (LP: #2166363) - xfs: add a xchk_ip_set_corrupt helper - xfs: rtsummary scrub should treat rtbitmap corruption errors as an xref error - xfs: hoist per-bucket unlinked list check to helper - xfs: don't livelock in scrub on a circular unlinked list - PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept - iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown - iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages - ALSA: FCP: Use a private URB for the notification endpoint - ALSA: scarlett2: Use a private URB for the notification endpoint - rndis_host: add overflow check in rndis_rx_fixup() - nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() - io_uring/futex: don't mark futex wake requests as inflight - ALSA: dummy: Check card index validity at probe - io_uring/cmd: fix iovec leak when the async cmd is not recycled - io_uring/io-wq: fix worker accounting when canceling creation callbacks - io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec() - io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd - ocfs2: fix missing metadata reservation for large xattrs - kcov: fix data corruption and race conditions on PREEMPT_RT - ext4: stop retrying saturated xattr cache entries - nilfs2: reject invalid block index in GC ioctl - ext4: clear error before retrying inode xattr space fallback - ext4: avoid tail write_begin walk for uptodate folios - ext4: propagate errors from fast commit range replay - ext4: don't enable DAX on new encrypted files - ext4: fix incorrect function call when initializing s_resgid - xfs: validate attr entry pointer before field access - nfc: digital: clamp SENSF_RES length to the destination buffer - nfc: fdp: bound the device-reported read length and fix an skb leak - nfc: microread: validate target discovery payload lengths - nfc: llcp: bound the connect_sn TLV walk to the skb - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers - nfc: llcp: reject PDUs shorter than the LLCP header - nfc: pn533: purge fragmented skbs during cleanup - nfc: st21nfca: validate ATR_REQ length against the received frame - nfc: nci: add data_len bound checks to activation parameter extractors - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers - nfc: nci: free destination parameters when closing a connection - drm/xe: Fix DPT allocation paths. - ipv4: reject undersized MTUs in ip_do_fragment() - ipv6: fix use-after-free in ip6_finish_output2() - mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf() - dmaengine: fsl-edma: Add error handling for devm_kasprintf - nvmet-auth: zero the AUTH_RECEIVE response buffer - nvmet-fc: fix invalid free in LS IOD error path - nvmet-tcp: bound SGL data length before allocating command buffers - nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations - nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work() - nvmet: pci-epf: put CQ ref on create_cq mapping failure - mptcp: pm: use for_each_subflow helper - mptcp: pm: rename add_entry structure to add_addr - mptcp: pm: uniform announced addresses helpers - mptcp: pm: fix memory leak from alloc-during-teardown race - HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C - HID: magicmouse: re-enable multitouch after reset-resume - HID: magicmouse: do not keep a stale msc->input if no input is claimed - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID - HID: core: fix OOB read of field->usage in hid_set_field() - HID: pidff: fix OOB write when hid->inputs is empty - net/ionic: avoid OOB TX partner lookup for hwstamp RXQ - futex/pi: Reject cross-mm private futex owners - futex: Sanitize and document task_struct::futex::state transitions - futex/pi: Plug private futex exec() race - futex: Fix race on the initial mm->futex.phash.ref allocation - futex: Fix might_sleep() warning in futex_pivot_pending() - HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() - HID: nintendo: register input device after capabilities are set - HID: nintendo: stop device IO before hid_hw_stop on probe failure - HID: core: fix number/pointer type confusion on long items - HID: sensor: custom: Fix use-after-free in enable_sensor - HID: uclogic: fix use-after-free of inrange_timer on remove - HID: hyperv: validate initial device info bounds - Bluetooth: hci_event: fix LE list UAF on reset - Bluetooth: hci_event: validate LE Set CIG Parameters response - Bluetooth: hci_sync: Fix accept list UAF during suspend - Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync - Bluetooth: ISO: zero the sockaddr before returning it in getname - Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 - Bluetooth: hci_aml: validate firmware segment lengths - futex: Avoid private hash use-after-free on final put - io_uring/futex: only mark private futex waits as inflight - io_uring: switch struct io_ring_ctx internal bitfields to flags - io_uring: defer eventfd signaling when queued from a wakeup handler - xfs: restore nofs context unconditionally in xfs_trans_roll - fbdev: Wrap user-invoked calls to fb_set_var() in helper - fbdev: serialize mode sysfs access with lock_fb_info() - HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() - HID: asus: fix missing hid_is_usb() check - HID: rapoo: fix missing hid_is_usb() check - HID: ft260: fix stack-use-after-return write in I2C read race - HID: input: read battery capacity from its actual report offset - Upstream stable to v6.18.47, v6.18.48, v7.1.11, v7.1.12 * Resolute update: upstream stable patchset 2026-09-03 (LP: #2166363) // CVE-2026-80590 - inet: frags: strip GSO state from fragments before reassembly * Resolute update: upstream stable patchset 2026-09-03 (LP: #2166363) // CVE-2026-80724 - ptp: vmclock: prevent read-only mappings from becoming writable * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) - mount: honour SB_NOUSER in the new mount API - sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag") - selftests/bpf: Fail unbound UDP on sockmap update - drm/amd/display: Add AV mute wait frames to dce110_set_avmute - drm/amd/display: Check for tg ops in dce110_set_avmute - arm64: dts: qcom: purwa: Fix GPU IOMMU property - arm64: dts: qcom: sdm850-lenovo-yoga-c630: lower PSCI cluster idle - arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer - ARM: npcm: Fix OF node refcount leaks in SMP setup - selftests/sched_ext: Handle sleeping task affinity changes in numa test - pinctrl: qcom: ipq806x: mark gpio as a GPIO pin function - pinctrl: qcom: ipq806x: mark pci reset as a GPIO pin function - ovpn: add missing rtnl_link_ops->get_size callback - ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt - ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET - ovpn: ensure socket is owned by ovpn before deref sk_user_data - ovpn: zero-initialize sockaddr before learning a floated endpoint - ovpn: hash floated peer by transport identity only - ovpn: disable IPv4 redirects on MP interfaces - ovpn: ensure TCP vars are initialized first - ovpn: fix incorrect use of rcu_access_pointer() - drm/bridge: ps8640: propagate AUX transfer register errors - net: hns3: fix speed configuration residue after driver reload - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" - net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock - pds_core: keep the health thread stopped during reset - pds_core: cancel pending PCI reset work on AER recovery - netfilter: ipset: switch ext_size to atomic64_t - ipvs: return the csum validation for forward hook - watchdog: bd96801_wdt: Fix timeout for enabled WDG - bpf: split check_reg_sane_offset() in two parts - bpf: Propagate untrusted pointer state in commuted arithmetic - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - counter: microchip-tcb-capture: Fix DT channel validation - vhost/vdpa: reject overflowing PA map page counts on 32-bit - hwmon: (pmbus_core) Use guard() for mutex protection - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() - bnxt: fix memory leak in bnxt_queue_mem_alloc error cases - xsk: pass TX metadata pointer by reference - xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h - drm/xe/uc: Apply RCS/CCS yield policy to SR-IOV VFs - hwmon: (nzxt-smart2) Check return value of init_device() in probe - hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations - selftests/ftrace: refactor eprobes test to fix argument checks - net: stmmac: resume PHY before hardware setup when opening the interface - bnge: use int for bnge_fix_rings_count() return value - bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss() - bnxt_en: Determine and store default RX ring in vnic structure - bnxt_en: Refresh VNIC default ring on queue restart if needed - bnxt_en: Fix PTP PPS setting bug - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - net: remove WARN_ON_ONCE() from sk_mc_loop() - ata: pata_sl82c105: fix bridge revision use-after-free - bnge: Fix resource leak in bnge_init_nic() error path - tls: don't abort the connection on signal-interrupted sends - hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination - hwmon: (ads7828) Fix external VREF regulator handling - hwmon: (ltc4282) Avoid overflow in maximum power calculation - hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt - usb: core: Add quirk for 255-bytes initial config read - usb: quirks: Add ShanWan gamepad to quirk list - thunderbolt: icm: Preserve USB4 proxy data-valid bit - usb: cdnsp: fix incorrect endian conversions for APB timeout register - ipvs: add totalconns for dest - ipvs: properly update the overload flag on dest edit - net: octeontx2-pf: Fix UB in shift operation - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header - KVM: s390: pci: Fix aisb calculation - dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk - Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan - Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV - selftests/bpf: Ensure UDP sockets are bound - selftests/bpf: Adapt sockmap update error handling - mei: pull kvfree out of spinlock - nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI - nvmem: layouts: Add fixed-layout driver - rust_binder: do not query current thread for all ioctls - serial: amba-pl011: fix indefinite RS485 post-send delay - serial: amba-pl011: synchronize DMA teardown - misc: fastrpc: Fix initial memory allocation for Audio PD memory pool - misc: fastrpc: fix channel ctx ref leak when session alloc fails - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - ring-buffer: Fix crash passing ERR_PTR to kthread_stop() - mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD} - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs - ALSA: hda/tas2781: fix ACPI reference handling - net: phy: mediatek: fix TX blink masks using the RX bits - arm64: remove redundant concurrent ptdump UAF mitigation - x86/CPU: Add a tlbi= cmdline switch - x86/mce: Set up the polling timer before CMCI discovery - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page - sched/psi: Create the psimon kthread outside of cgroup_mutex - fsverity: Fix silent truncation in bpf_get_fsverity_digest() - scsi: scsi_debug: Negate wrapped memcmp() result - thunderbolt: Fix bandwidth group reservation indexing - netfilter: flowtable: ensure sufficient headroom in xmit path - arm64: dts: qcom: monaco: Add default GIC address cells - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails - btrfs: lzo: add error message for invalid headers - btrfs: initialize inode mapping flags for cached inodes - hwmon: (pmbus/core) Avoid race condition during probe - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie - net: qrtr: ns: Raise lookup limit to 128 - hwmon: Support guard() and scoped_guard for subsystem locks - hwmon: (corsair-psu) serialize debugfs access against hwmon - usbnet: cap max_mtu for drivers without bind callback - ipvs: separate destination availability state - selftests/xsk: fix too-many-frags multi-buffer Tx test - selftests/xsk: account reclaimed invalid Tx descriptors - serial: sc16is7xx: enable THRI before filling TX FIFO - mm/huge_memory: initialise workingset state before folio split - net: ntb_netdev: Introduce per-queue context - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() - ring-buffer: Prevent resizing of persistent ring buffer - Revert "thermal: hwmon: Register a hwmon device for each thermal zone" - selinux: require every boolean value to be defined - selinux: reject a class permission count below its inherited common - selinux: do not cancel a policy conversion that never started - selinux: reject an unclaimed class value in security_get_classes() - selinux: reject a permission value exceeding the class permission count - selftests: mptcp: join: mark tests with data corruption as failed - mptcp: pm: fix data race in add_addr timer callback - ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() - ASoC: cs4265: sort the register default table - ASoC: cs35l45: sort the register default table - ASoC: cs35l41: sort the register default table - ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses - drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 - drm/amdgpu: fix JPEG v5.0.0 queue reset failure in DPG mode - drm/amdgpu: fix JPEG v4.0.5 queue reset failure in DPG mode - drm/amdgpu: fix aperture iounmap skipped on device removal - ASoC: SOF: topology: Use acpi mach from the machine driver - Input: xpad - add support for ZENAIM LEVERLESS - powerpc/pseries: pci - logic bug - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo - Input: psxpad-spi - set driver data before use - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard - powerpc/pseries: lparcfg - fix kbuf[] underflow - crypto: starfive - use scatterlist length before DMA mapping - selftests/ftrace: Convert ELF entry point to file offset in uprobe test - gve: fix zero-length skb frag with header-split - pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0 - ftrace: Protect direct_functions in ftrace_find_rec_direct - ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() - Input: sur40 - fix V4L error path cleanup - ceph: fix MDS random selection readiness predicate - libceph: tolerate addrvecs with multiple entries of the same type - mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit - mmc: sdhci: unmap the bounce buffer before device release - pmdomain: mediatek: fix remaining %pOF after of_node_put() - mmc: sdhci: make tuning_err a signed int - pmdomains: mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE - drm/connector/hdmi: Fix out of bounds memory read - mmc: loongson2: Fix sg iteration in data reorder functions - pmdomain: mediatek: Fix mt8183 hang on boot - drm/xe: Order ring writes before ring tail updates - drm/xe: Fix xe_device_probe() failure - drm/radeon: fix autosuspend cleanup during teardown - s390/vfio_ccw: Calculate idal length based on idaw type - s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code - drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix - drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE - drm/amdgpu: Reject UVD message with invalid number of h265 refs - drm/amdgpu: fix nbif 6.3.1 l1 low power not functional - drm/amdgpu: check ASPM on the dGPU host link - drm/amdgpu: Reject UVD message with dimensions above 4096 - drm/amdgpu: Fix UVD min buffer sizes - drm/amdgpu: Fix UVD dpb min size calculation for H264 - xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems - xfs: clear zapped attr fork state when bmap repair finds no attr fork - xfs: check cowextsize in xrep_inode_cowextsize - xfs: fix transaction block reservation in xrep_rtbitmap - xfs: zero i_nlink before repair puts inode on unlinked list - xfs: only check mergeability of bnobt records - xfs: set the prev pointer when reinserting an inode on the unlinked list - xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers - xfs: nlink scrub must take IOLOCK before determining ILOCK state - xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev - xfs: don't zap the attr fork on repair when there are queued pptr updates - xfs: fix allocated inodes that show up in the unlinked list - xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers - xfs: don't ignore runtime errors in xrep_iunlink_reload_next - xfs: check xfarray iteration errors when committing unlinked inode lists - xfs: check v5 superblock features early - futex: Fix race in futex_pivot_pending() during private hash resize - sched_ext: Update p->scx.disallow warning in scx_init_task() - sched_ext: Reorganize enable/disable path for multi-scheduler support - ring-buffer: Store bpage pointers into subbuf_ids - arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 - crypto: ccm - Set rfc4309 maxauthsize from child - riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions - gpio: ml-ioh: share the register lock across channels - ASoC: tas2781: fix clang build error for goto bypassing cleanup variable - netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path - netfilter: ipset: fix list type element drift bug - netfilter: ipset: let destroy callbacks adjust ext mem size - eth: bnxt: cancel IRQ notifier before freeing affinity mask - eth: bnxt: keep the aRFS rmap updated when TPH is enabled - tcp: fix icsk_ack.ato bitfield overflow - net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path - net: packet: fix wrong transport_header when sending VLAN-tagged frame - net: tap: fix wrong transport_header when sending VLAN-tagged frame - net/tls: Fail tls_sw_splice_read() after a failed async decrypt - ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers - regmap: sdw-mbq: Fix swap of timeout and retry times - af_packet: Don't send zero-byte data in tpacket_snd(). - m68k: Define NR_CPUS to 1 - accel/amdxdna: Skip unmapped range in aie2_populate_range() - drm/xe/oa: Fix sync entry leak on OA config emit failure - drm/log: Fix out-of-bounds read on empty message length - drm/log: Fix infinite loop when scale is too large for display - spi: virtio: mark device ready before registering the controller - erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms - ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r - drm/amdgpu/userq: serialize queue map against GPU reset - drm/amd: Disable DP audio spread spectrum for Cyan Skillfish - drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression - drm/amdgpu: fix JPEG v5.3.0 queue reset failure in DPG mode - drm/amdgpu/gmc12.1: implement tlb inv semaphore - drm/amdgpu/gmc12.1: fix MMHUB0 check in pasid tlb flush - Input: atkbd - skip deactivate for HONOR ZQC-P - pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() - ftrace: Protect direct_functions in update_ftrace_direct_del - ftrace: Protect direct_functions in update_ftrace_direct_mod - drm/xe/guc_ads: allocate UM queues in a separate BO - drm/xe/guc_ads: allocate UM queues in VRAM on dGFX - drm/xe/guc_ads: use uncached mapping for UM queue BO - drm/amdgpu: fix missing check in vm_flush() - drm/amdkfd: Add bounds check for CRAT subtype length - net: rename netdev_ops_assert_locked() - clk: spacemit: k3: fix USB2 bus clock - gpiolib: Check gc->get_direction() before calling gpiod_get_direction() - regulator: fp9931: Fix VPOS/VNEG voltage selector table - ovpn: run deferred work on a module-owned workqueue - tick: Include ktime.h and jiffies.h in linux/tick.h - eth: bnxt: decrease indent in bnxt_request_irq() - drm/xe/pxp: add termination on resume - drm/xe/oa: Check managed mutex initialization errors - drm/xe: Set GT rp min frequency as 1.2GHz default for BMG/CRI - drm/xe: Fix a bug in pc_adjust_freq_bounds() - drm/log: Fix division by zero when scale module parameter is 0 - Upstream stable to v6.18.45, v6.18.46, v7.1.9, v7.1.10 * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74735 - l2tp: fix tunnel and session refcount leak on seq_file release * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74745 - eth: bnxt: avoid deadlock when canceling IRQ affinity notifier * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74747 - ipvs: revalidate ihl to prevent out-of-bounds access * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74750 - ovpn: defer key slot crypto freeing to workqueue * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74752 - sctp: validate cookie AUTH state before use * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74754 - scsi: core: pair EH runtime PM get and put * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80521 - af_unix: Unlink scc_entry in unix_del_edge(). * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80523 - clk: spacemit: k3: set hdma clock as critical * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80524 - optee: ffa: Add NULL check in optee_ffa_lend_protmem * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80557 - libceph: fix OOB read in decode_watchers() via missing bounds check * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80579 - fbdev: clear fb_info->mode before deleting a videomode * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80580 - fbdev: bound mode sysfs output to the sysfs buffer * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80582 - drm/shmem_helper: Check VMA boundaries for PMD mappings * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80583 - ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74734 - firewire: ohci: fix NULL pointer dereference in ar_context_release * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74736 - net/sched: cls_bpf: reject dev-bound programs bound to a different device * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74737 - net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74738 - regmap: sdw-mbq: don't call an unset readable_reg callback * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74739 - net/sched: cls_u32: skip hash tables in u32_bind_class() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74740 - net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74741 - net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74742 - veth: fix queue index used to wake the peer txq in veth_poll * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74743 - macvlan: inherit needed_headroom and needed_tailroom from lowerdev * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74744 - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74746 - netfilter: flowtable: publish GC-visible tuple last * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74748 - netfilter: ipset: fix refcount race between list:set GC and swap * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74753 - perf: Reject exited events as group leaders * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80519 - ovpn: finish crypto callback cleanup before peer release * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80520 - ovpn: fix NULL dereference when killing missing key * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80522 - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80525 - ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80526 - ASoC: tas2562: Validate values for volume writes * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80527 - ceph: fix hanging __ceph_get_caps() with stale mds_wanted * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80528 - ceph: avoid fs reclaim while using current->journal_info * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80529 - xfs: don't swallow dquot recovery verification errors * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80530 - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80531 - xfs: avoid UAF on sc->tempip in xrep_tempfile_create * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80532 - xfs: fix another iunlink infinite loop bug in online fsck * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80533 - xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80534 - xfs: fix ilock leak on error in xfs_dq_get_next_id * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80535 - xfs: don't double-lock when deleting a self-referential directory * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80536 - xfs: bounds-check buffer log item's dirty bitmap * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80537 - xfs: fix off-by-one in rtrefcount btree root level validation * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80538 - xfs: propagate errors from xfs_rtginode_load * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80539 - drm/amdgpu: disallow multiple FENCE chunks in one submit * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80540 - drm/amdgpu: Fix UVD decode image min size calculation * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80541 - drm/amdgpu: validate GEM_CREATE domain combinations * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80542 - drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80547 - s390/vfio_ccw: Implement a crw lock * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80548 - s390/vfio_ccw: Selectively expand io_mutex * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80549 - s390/vfio_ccw: Move cp cleanup out of not operational * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80550 - s390/vfio_ccw: Fix out of bounds check on CCW array * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80551 - s390/vfio_ccw: Ensure first IDAW remains constant * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80552 - s390/vfio_ccw: Ensure index for read/write regions are within range * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80553 - s390/vfio_ccw: Cancel existing workqueues * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80554 - s390/vfio_ccw: Limit the number of channel program segments * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80555 - s390/vfio_ccw: Free all memory if cp_init() fails * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80556 - mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80558 - libceph: Avoid using invalid osd indices from primary_temp * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80559 - Input: sur40 - fix input device registration ordering * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80560 - openrisc: signal: do not restore privileged SR bits on sigreturn * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80561 - libceph: fix multiple unsafe decodes in decode_locker() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80562 - gpio: ml-ioh: use raw_spinlock_t for the register lock * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80563 - gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80564 - gve: fix NULL dereference due to missing ptp adjfine * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80565 - crypto: qce - fix error path in devm_qce_register_algs * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80566 - Input: hynitron_cstxxx - validate touch count and finger IDs * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80567 - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80568 - Input: synaptics-rmi4 - block s_input when F54 queue is busy * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80569 - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80570 - Input: synaptics-rmi4 - zero report size on F54 work error * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80571 - powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80572 - Input: byd - synchronize timer deletion before freeing private data * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80573 - Input: iforce - validate input packet lengths * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80574 - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80575 - Input: cs40l50-vibra - validate custom data from user space * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80576 - drm/amdgpu: reject oversized IBs with per-ring packet limits * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80577 - drm/panthor: skip zero-sized firmware sections * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80578 - fbdev: core: Fix pointer desynchronization in fb_io_read() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80581 - ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80584 - s390/qeth: validate user buffer length in SNMP and ARP query ioctls * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80585 - mptcp: fastopen: only mark MPTFO subflows with SYN data * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80586 - mptcp: options: reset DSS fields in case of unexpected size * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80587 - mptcp: avoid combining some incoming suboptions * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80588 - mptcp: reclaim forward-allocated memory on RX path errors * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-80589 - block: stop the timeout timer when releasing a never added disk * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74593 - sched_ext: Take cgroup_lock() first in scx_cgroup_lock() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74596 - fs,fsverity: remove check for fsverity being enabled in setattr_prepare() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74600 - mm/page_table_check: skip special zero mappings * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74605 - eventfs: Use children field for rcu head and add memory barriers * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74626 - NTB: ntb_netdev: Preserve RX queue depth on allocation failure * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74645 - mm/damon/lru_sort: error out for >10000 active_mem_bp * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74674 - mm: fix incorrect flush address in direct page table reclaim * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74686 - rqspinlock: Reset tail when preserving queue on deadlock * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74699 - drm/xe: Fix memory leak in exec_queue_set_hang_replay_state() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74706 - bnge: Fix NULL pointer dereference in aux device release * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74713 - vhost_iotlb: bound map allocation in add_range * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74715 - bpf: Fix netns reference imbalance in conntrack kfuncs * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74716 - accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74721 - accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74723 - btrfs: lzo: reject inline extents without valid headers * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74729 - soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74733 - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74585 - thunderbolt: Bound the DROM dual link port number before indexing sw->ports * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74586 - sctp: clear new_transport when removing a peer * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74587 - sctp: fix use-after-free of cached ASCONF chunk * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74588 - sctp: keep chunk->transport in step with the list it is queued on * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74589 - bpf, sockmap: Fix sk_redir use-after-free in send verdict * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74590 - fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74591 - mm/filemap: __filemap_add_folio() restore index before retrying * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74592 - ima: Instantiate file_truncate and path_truncate hooks * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74594 - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74595 - fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74597 - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74598 - ipv6: fix Route Information option length validation * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74599 - mm/ptdump: always stabilise against page table freeing using init_mm * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74601 - ring-buffer: Use current_context for safe per-CPU buffer swap * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74602 - ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74603 - ptp: ocp: Fix board ID over-read * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74604 - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74606 - eventfs: Fix use-after-free in eventfs_remove_rec() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74607 - KVM: SVM: Serialize accesses to the owner and mirror list with separate lock * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74608 - smb: client: Fix use-after-free in cifs_try_adding_channels() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74609 - tipc: read le->link under the node lock in tipc_node_link_down() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74610 - tls: don't leave a full plaintext sk_msg ring unpushed * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74611 - tls: rx: restore msg_iter before TLS 1.3 optimistic retry * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74580 - vhost: reset the vring metadata cache on vring reconfiguration * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74612 - veth: fix skb length accounting after XDP frag adjustment * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74613 - vsock/virtio: avoid refilling the RX queue after teardown * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74614 - vsock/virtio: read virtqueues under worker locks * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74615 - vxlan: do not arm the ageing timer on a device that is down * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74616 - xdp: reject clones that overrun skb_shared_info tailroom * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74617 - dibs: initialise dibs->lock in dibs_dev_alloc() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74618 - binfmt_misc: don't warn when the mount is completed from another user namespace * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74619 - ovl: don't warn when the mount is completed from another user namespace * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74620 - net/sched: act_gact, act_police: range check the fallback control action * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74621 - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74622 - net: atlantic: free RX pages of consumed but not refilled buffers * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74623 - net: atlantic: free stranded TX buffers on ring deinit * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74624 - netfilter: nf_conntrack: defer invalid log until after unlock * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74625 - netfilter: bridge: release template ct on non-IP path * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74627 - net: devmem: prevent net-iov / page mixing * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74628 - net/x25: fix use-after-free of the socket by its timers * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74629 - net/dibs: Correct freeing of dmb_clientid_arr * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74630 - ipv6: prevent in6_dev_get() from resurrecting inet6_dev * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74631 - net: smc: fix splice entry lifetime imbalance in smc_rx_splice * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74632 - mm/huge_memory: fix huge_zero_pfn race * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74633 - tracing: Fix NULL pointer dereference in module event cache removal * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74634 - ring-buffer: Prevent subbuf order change when resizing is disabled * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74635 - fbdev: bitblit: bound-check glyph index in bit_cursor() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74636 - tracing: Fix race between update_event_fields and, event_define_fields * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74637 - perf/core: Fix group leader use-after-free after sibling detach * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74638 - drm/v3d: Serialize the scheduler timeout handlers * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74639 - ALSA: us144mkii: re-anchor capture URBs on resubmission * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74640 - ALSA: FCP: fix OOB write in fcp_meter_ctl_get() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74641 - ALSA: usx2y: bound the hwdep mmap fault offset * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74643 - samples/damon/mtier: error out for zero quota goal target values * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74644 - mm/damon/ops-common: putback folios on invalid migrate nid * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74646 - misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74647 - misc: fastrpc: Remove buffer from list prior to unmap operation * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74648 - staging: rtl8723bs: validate monitor transmit frame lengths * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74649 - staging: rtl8723bs: fix missing shared-key auth challenge length check * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74650 - staging: rtl8723bs: fix OOB read in WMM_param_handler() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74651 - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74652 - serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74653 - serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74654 - serial: 8250_dma: Clear stale RX state on shutdown * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74655 - serial: qcom-geni: fix TX DMA buffer flush * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74656 - ipv4: fix use-after-free in fib_nhc_update_mtu() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74657 - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74658 - futex: Prevent robust futex exit race some more * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74659 - net: bridge: mrp: fix uninitialised bytes on the wire * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74660 - netfilter: ebt_nflog: pin the NFLOG backend * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74661 - mac802154: fix netdev use-after-free in beacon worker * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74662 - inet: frags: publish queues before arming timer * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74663 - net/sched: reject overly deep qdisc hierarchies * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74664 - net: openvswitch: reallocate update replies for mismatched IDs * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74665 - net: fix skb length accounting after generic XDP frag adjustment * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74666 - packet: synchronize pressure clearing with ring reconfiguration * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74667 - net/packet: reset the MAC header on the packet-socket transmit path * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74668 - packet: use consistent hard_header_len in TX_RING send path * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74582 - packet: use consistent hard_header_len in non-ring send paths * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74669 - ipvs: clear IPv4 options after rebasing tunnel ICMP errors * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74670 - ipvs: stop estimator after disabled calc phase * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74671 - ima: fix out-of-bounds read in xattr_verify() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74672 - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74673 - Input: evdev - fix information leak in evdev_pass_values() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74675 - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74676 - vt: add permission check for KDSKBMETA ioctl * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74677 - net: usb: ipheth: fix carrier_work UAF on disconnect * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74678 - net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74679 - usb: gadget: f_ncm: Use unsigned int for ndp_index * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74680 - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74681 - usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74682 - ALSA: usb-audio: fix OOB write on Type II inbound URBs * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74683 - Input: evdev - sanitize event type index when fetching event masks * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74684 - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74685 - hwmon: (ltc4282) Clamp negative current limits * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74687 - watchdog: at91sam9_wdt: prevent timer rearm during teardown * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74688 - sctp: clear control chunk transport if it is being removed * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74689 - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74690 - s390/ism: Fix UAF of sba and ieq during ism_dev_exit() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74691 - net: thunderbolt: Tear down DMA paths before stopping the rings * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74692 - net/smc: fix TOCTOU race between smc_listen_out() and listener close * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74693 - net: prestera: validate firmware header length * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74694 - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74695 - netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74696 - tcp: fix TFO max_qlen accounting across reuseport migration * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74697 - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74698 - net/mlx5e: fix BQL reset on SQ re-activation * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74700 - net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74701 - net/openvswitch: check Ethernet header length in key_extract() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74702 - vhost-scsi: reject feature changes after endpoint * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74703 - vhost-scsi: Validate T10 PI scatterlist counts * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74704 - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74705 - udp: fix potential use-after-free in tunnel segmentation * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74707 - xsk: validate metadata when processing requests * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74708 - xsk: validate launch-time metadata size * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74709 - xsk: clear metadata pointer when no timestamp is requested * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74710 - xsk: require at least 16 bytes of TX metadata * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74711 - hwmon: (pmbus) Fix type confusion in notification logic * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74712 - vdpa/mlx5: Fix buffer length in create_direct_keys() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74714 - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74717 - net/mlx5: fw_tracer, return NULL on create error * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74718 - devlink: fix net namespace reference leak in reload * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74583 - net/sched: cls_route: fix fastmap use-after-free on filter * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74719 - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74720 - bpf: Preserve pointer state for commuted arithmetic * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74722 - btrfs: fix memory leak in btrfs_do_encoded_write() * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74724 - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74725 - enic: fix tx_hang_reset use-after-free on device removal * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74726 - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74727 - ovpn: skip rehash for peers already removed from by_id * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74728 - xfs: handle NULL b_addr in xfs_buf_free * Resolute update: upstream stable patchset 2026-09-01 (LP: #2166029) // CVE-2026-74730 - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) - kunit: tool: skip stty when stdin is not a tty - kunit: tool: Terminate kernel under test on SIGINT - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() - ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1 - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() - pinctrl: qcom: Unconditionally mark gpio as wakeup enable - pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() - selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE - Revert "UBUNTU: SAUCE: selftests/seccomp fix compilation issue for amd64" - selftests/seccomp: Fix pointer type mismatch build error - ata: sata_mv: accept 1 or 2 resources in platform probe - ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() - phy: qcom: m31-eusb2: Fix return value of init call - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - of: reserved_mem: prevent OOB when too many dynamic regions are defined - btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag - btrfs: zoned: reset meta_write_pointer on zone reset - btrfs: raid56: fix an incorrect csum skip during scrub - phy: zynqmp: fix clock error handling in xpsgtr_phy_init() - phy: zynqmp: fix runtime PM leak on probe allocation failure - drm/mediatek: Check CRTC state before freeing - Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation - mshv: Fix duplicate GSI detection for GSI 0 - mshv: Fix sleeping under spinlock in mshv_portid_alloc - KVM: arm64: Reject guest_memfd memslots when the VM has MTE - KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type - assoc_array: trim the final shortcut word using the current chunk end - ipvs: fix the checksum validations - ipvs: fix places with wrong packet offsets - ipvs: do not mangle ICMP replies for non-first fragments - ASoC: SDCA: Ensure that Control Range is large enough for header - af_unix: fix listen() succeeding on sockets in the wrong state - selftests/net/af_unix: test listen() rejects wrong socket states - pinctrl-amd: Don't clear S4 wake bits at probe - smb: client: fix buffer leaks in SMB1 read and write - ASoC: tas2781: Use correct calibration data for SINEGAIN2 register - spi: spi-cadence: Move TX FIFO full busy-wait into FIFO - hwmon: (ina2xx) Make it easier to add more devices - hwmon: (ina2xx) Add support for INA234 - hwmon: (ina2xx) Shift INA234 shunt and current registers - hwmon: (ina2xx) Fix various overflow issues - hwmon: (ltc4282) Fix reading the minimum alarm voltage - hwmon: (sht3x) Fix unaligned accesses - net: bridge: mrp: fix Option TLV length in MRP_Test frames - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - hwmon: (adt7470) Fix cache updated before hardware write on I2C error - hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Use cached PWM frequency value - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - powerpc/boot: Fix simpleboot CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix treeboot-akebono CPU node lookup check - wifi: mac80211: validate individual TWT params before driver setup - netfs: clear PG_private_2 on copy-to-cache append failure - netfs: handle single writeback rolling buffer allocation failure - netfs: release readahead folios on iterator preparation failure - net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - idpf: adjust TxQ ring count minimum - idpf: Fix mailbox IRQ name leak on request failure - ice: suppress DPLL errors during reset recovery - Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths - Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos - Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() - Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release - Bluetooth: ISO: ensure no dangling hcon references in iso_conn - Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists - Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync - x86/boot: Add volatile, clobbers and zero-length test in memcmp() - net: phylink: put link_gpio if phylink_create fails - scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE - scsi: ufs: core: Cancel RTC work in active-active suspend - scsi: ufs: core: Avoid IRQ thread wakeup during active UIC command - scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler" - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - scsi: target: Clear cmd_cnt when initial counter enrollment fails - net: sxgbe: check descriptor ring allocation failures - can: isotp: check register_netdevice_notifier() error in module init - drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder - fprobe: Fix module reference count leak on error in register_fprobe() - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions - riscv: drop __init from vec_check_unaligned_access_speed_all_cpus - accel/qaic: use sizeof(*trans_hdr) for transaction length check - net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend - net: dsa: mt7530: error out on failed reads in MT7531 PHY polling - ptp: netc: fix potential interrupt storm caused by incorrect unbind order - net: libwx: fix FDIR ATR queue mismatch for software VLAN packets - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - sched/deadline: Use revised wakeup rule only for running dl_server - spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs - drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status - ksmbd: return success for deferred final close - iomap: add a separate bio_set for iomap_split_ioend - mshv: Fix race in mshv_irqfd_deassign - mshv: Fix level-triggered check on uninitialized data - mshv: Order pt_vp_array publish against irqfd assertion path - iommufd/viommu: Release the igroup lock on the vdevice_size error path - iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds - iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace - pinctrl: microchip-sgpio: add missing select REGMAP_MMIO - erofs: cap LZMA stream pool size - [Config] Add EROFS_FS_LZMA_DEFAULT_MAX_STREAMS - pinctrl: bm1880: add missing select GENERIC_PINCONF - fortify: Disable -Wstringop-overread in tests - mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE - mm/util: don't read __page_2 for order-1 folios in snapshot_page() - selftest: fix headers in fclog.c - fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() - mm/vmstat: fold stranded per-cpu node stats when a node comes online - tracing/probes: Reject $arg0 in meta argument expansion - tracing/fprobe: Roll back on enable_trace_fprobe() failure - KVM: VMX: add memory clobber to asm for VMX instructions - KVM: s390: pci: Fix missing error codes and memory unaccounting - KVM: s390: pci: Fix NULL dereference on AIBV allocation failure - KVM: s390: pci: Validate AIBV and AISB before pinning guest pages - sctp: validate Adaptation Indication parameter length - audit: fix potential integer overflow in audit_log_n_string() - Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() - Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() - Bluetooth: SCO: give the socket its own sco_conn reference - bpf: lwt: Fix dst reference leak on reroute failure - afs: Fix afs_fs_fetch_data() to set call->async - afs: Fix afs_fs_fetch_data() to subtract transferred from len - ALSA: hda/realtek: Add quirk for TongFang X6SP45xU - ALSA: lx6464es: fix period byte count for 16-bit streams - ALSA: pcm: wake linked drain waiters on unlink - ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return - ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return - ASoC: tas2562: fix DVC coefficient write order - ASoC: tas2562: fix broken entries in the volume lookup table - ata: libata-eh: Increase STANDBY IMMEDIATE timeout - ata: libata-sata: fix ata_scsi_lpm_supported() iteration - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - e1000: fix memory leak in e1000_probe() - igc: remove napi_synchronize() in igc_down() - ipvs: do not propagate one-packet flag to synced conns - mshv: fix hv_input_get_system_property struct - io_uring/net: initialize mshot_len for send - mm: memcg: initialize *locked in memcg1_oom_prepare() stub - net: ipv6: clear suppressed fib6 rule result - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - vxlan: re-fetch eth header after route_shortcircuit() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - tracing/filters: Fix false positive match in regex_match_full() - spi: spi-qpic-snand: write the feature value before executing SET_FEATURE - spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure - selftests/mm: fix potential wild pointer access of getline due to missing init - selftests/clone3: fix wild pointer access of getline due to missing init - sctp: reject stale cookies with mismatched verification tags - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - hwmon: (pmbus/core) notify on the hwmon device, not the i2c client - i2c: amd-mp2: Unregister callback on adapter add failure - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure - cifs: add fscache_resize_cookie() to cifs_setsize() - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized - power: supply: bq25890: fix the -10 C NTC lookup entry - power: supply: max17040: handle missing status supplier - s390/pci: Fix s390_pci_mmio_write syscall error return without MIO - s390/dasd: Fix potential NULL pointer dereference - s390/dasd: Fix undersized format-check buffer - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - net: openvswitch: fix skb leak on flow key update failure during recirculation - ice: fix VF interrupts cleanup - ice: fix memory leak in ice_lbtest_prepare_rings() - i2c: spacemit: request IRQ after controller initialization - i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers - i2c: iproc: reset bus after timeout if START_BUSY is stuck - i2c: imx: Fix slave registration race and error handling - can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer - can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - can: softing: fw_parse(): validate firmware record spans - can: ctucanfd: add missing MODULE_DEVICE_TABLE() - can: ctucanfd: use self-test mode for PRESUME_ACK - can: ctucanfd: unmap BAR0 using base address - can: ctucanfd: handle bus error interrupts - can: ctucanfd: mark error-active controller status valid - drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs - drm/bridge: display-connector: Fix I2C adapter resource leak - drm/mediatek: ovl_adaptor: balance component registrations - drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini - drm/amdgpu: restore UMD profile pstate after runtime resume - drm/amd/pm: fix torn gpu metrics reads - drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames - drm/amd/display: use proper context for logging - drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE - drm/amdkfd: Handle invalid event type in CRIU event restore - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size - drm/vmwgfx: clamp dirty-page range with min, not max - drm/vmwgfx: take fman->lock around fence list mutation in fifo_down - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import - drm/vmwgfx: enforce cursor size limits for MOB cursors - drm/vmwgfx: use check_add_overflow for shader size+offset bound - drm/vmwgfx: validate external BO copy bounds for both stride paths - HID: logitech-dj: Fix maxfield check in DJ short report validation - drm/xe/rtp: Maintain OA whitelists separately - drm/xe/rtp: Keep track of non-OA nonpriv slots - drm/xe/rtp: Generalize whitelist_apply_to_hwe - drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs - drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt - drm/xe/oa: (De-)whitelist OA registers on OA stream open/release - drm/xe/rtp: Ensure locking/ref counting for OA whitelists - mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() - fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes - net/handshake: Close the submit-side sock_hold race - usb: typec: ucsi: split connector lock classes - media: chips-media: wave5: Support CBP profile - drm/xe: add xe_migrate_resolve wrapper and is_vram_resolve support - drm/xe/bo: Add purgeable bo state tracking and field madv to xe_bo - drm/xe/vm: Prevent binding of purged buffer objects - drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse] - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering - usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path - mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT - ALSA: hda/realtek: Add quirk for HP Dragonfly Folio G3 2-in-1 (103c:8a05) - KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context - dmaengine: idxd: fix double free of wq, engine, and group structs - btrfs: warn about extent buffer that can not be released - btrfs: zoned: skip fully truncated ordered extents at zone finish - rtla/timerlat_top: Fix on-threshold actions firing on signal - selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests - netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() - mshv_vtl: fix fd leak in mshv_ioctl_create_vtl() - ipvs: clear the nfct flag under lock - ASoC: SDCA: Correct pointer passed to devm_acpi_table_put - ASoC: SDCA: Always free firmware in FDL path - ASoC: SDCA: Make UMP message size check more robust - xsk: provide sufficient space in pool->tx_descs - net/sched: sch_cake: skip clearing unused tins during rate adjustment - erofs: clean up erofs_ishare_fill_inode() - erofs: remove fscache backend entirely - [Config] Remove EROFS_FS_ONDEMAND - erofs: ensure valid f_path for page cache sharing - ASoC: sophgo: return 1 on volume change in cv1800b_adc_volume_set() - ethtool: Embed FEC hist ranges as buffer in struct - idpf: bound interrupt-vector register fill to the allocated array - Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks - Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync - scsi: ufs: core: Initialize hba->rpmbs list in ufshcd - drm/xe/pt: check no-DMA huge-pte cases before DMA segment test - ipv6: release fib6_null_entry on subtree failure - riscv: vdso: Only try to install vDSO when present - net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling - net: stmmac: Fix E2E delay mechanism - net: mana: Create separate EQs for each vPort - net: mana: Return error code from mana_create_rxq() - mshv: Fix missing error code on VP allocation failure - mshv: Publish VP to pt_vp_array before installing the file descriptor - iommufd: Reject DMABUF pages from the access pin path - btrfs: raid56: fix scrub read assembly submitting no reads - btrfs: zoned: fix missing chunk metadata reservation - ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset - userfaultfd: wait on source PMD during UFFDIO_MOVE - KVM: s390: pci: Fix resource leak on IRQ registration failure - Bluetooth: btmtk: Fix short read errors in btmtk_usb_reg_read() - ata: libata-scsi: terminate deferred commands on time out - ata: libata-scsi: schedule deferred atapi command - PCI: imx6: Keep i.MX6 Root Port MSI/MSI-X Capabilities with iMSI-RX to work around hardware bug - io_uring: preserve task restrictions across exec - scsi: libsas: terminate deferred commands on time out - scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc - can: rcar_canfd: change the initializing flow for clocks and resets - drm/mediatek: mtk_hdmi: Fix DDC adapter double put in v2 - drm/amd/pm: hide pp_table sysfs on APUs - drm/amd/pm: use milliwatts for GPU power sensors - drm/amd/display: check if dml21_add_phantom_plane() is successful - drm/xe: Drop unused param from xe_device_create() - drm/xe: Move xe->info.force_execlist initialization - drm/xe: Move xe->info.devid|revid initialization - drm/xe: Drop unnecessary goto in xe_device_create - drm/xe: Separate early xe_device initialization - drm/xe: Set TTM device beneficial_order to 9 (2M) - Upstream stable to v6.18.44, v7.1.8 * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74449 - drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74450 - drm/amd/pm: fix pptable use-after-free * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74466 - s390/zcrypt: Close speculative mem read possibility * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74483 - binfmt_misc: don't leak the user namespace when the mount fails * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74496 - fou: Fix use-after-free in fou_create() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74517 - KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74521 - ksmbd: use memcmp() to compare ClientGUIDs * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74526 - scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74528 - Bluetooth: hci_sync: hold conn in hci_past_sync() callback * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74529 - Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74530 - Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74533 - Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74542 - netfs: Fix folio_queue ENOMEM in writeback by adding a mempool * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74544 - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74554 - wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74558 - xsk: reclaim invalid Tx descriptors in ZC batch path * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74561 - nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74562 - nexthop: take nh->lock for f6i_list walks in replace check and notify * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74571 - btrfs: skip global block reserve accounting for rescue mounts * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74440 - drm/xe: Wait on external BO kernel fences in exec IOCTL * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // [SRU] amdgpu: Fix garbled display when switching workspaces (LP: #2166730) - drm/amd/display: check GRPH_FLIP status before sending event - drm/amd/display: Exit idle optimizations before programming * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74441 - usb: typec: ucsi: Fix race condition and ordering in port unregistration * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74482 - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74442 - drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74443 - drm/vmwgfx: bound DMA command body size against suffix pointer * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74444 - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74445 - drm/vmwgfx: reject DX_BIND_QUERY without a DX context * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74446 - drm/amdkfd: hold event_mutex while checkpointing CRIU events * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74447 - drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74448 - drm/amdkfd: fix QID bit leak in pqm_create_queue() * [SRU] Fix incorrect GTT calculation on the APU systems (LP: #2162038) // Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) - drm/amdgpu: cap GTT size to physical RAM on APUs * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74451 - drm/panthor: validate firmware interface structure sizes * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74452 - drm/panthor: reject firmware sections with oversized data * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74453 - drm/vc4: Zero the tile state data array before each BIN job * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74454 - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74455 - can: peak_usb: validate uCAN receive record lengths * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74456 - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74457 - can: peak_usb: add bounds check for USB channel index * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74458 - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74459 - can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74460 - can: ems_usb: validate CPC message lengths * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74461 - i2c: imx: Cancel hrtimer before clearing slave pointer * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74462 - i2c: imx: mark I2C adapter when hardware is powered down * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74463 - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74464 - net: openvswitch: fix skb leak on flow key update failure during ct * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74465 - net: openvswitch: fix potential UAF on meter attach failure * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-68451 - s390/zcrypt: Validate length for CCA ECC private key requests * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-68452 - s390/zcrypt: Validate length for CCA AES cipher key requests * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-68453 - s390/zcrypt: Fix buffer over-read in cca_cipher2protkey * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74467 - s390/qeth: Check CAP_NET_ADMIN for private ioctls * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74468 - gpio: pch: use raw_spinlock_t for the register lock * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74469 - sctp: prevent peer transport count overflow * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74470 - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74471 - tracing: Check return value of __register_event() in trace_module_add_events() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74472 - ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74473 - vxlan: use pskb_network_may_pull() in route_shortcircuit() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74474 - vxlan: use pskb_network_may_pull() for transmit path header pulls * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74475 - vxlan: use neigh_ha_snapshot() in route_shortcircuit() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74476 - veth: convert frag_list skbs before running XDP * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74477 - uprobes: Fix NULL pointer dereference in hprobe_expire() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74478 - um: vector: fix use-after-free in vector_mmsg_rx() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74479 - net: pktgen: fix proc entry use-after-free * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74480 - net: bridge: stop fast-leave after deleting a port group * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74481 - mm/page_reporting: use system_freezable_wq to fix UAF during suspend * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74484 - binfmt_misc: don't let an 'F' entry pin its own instance * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74485 - binfmt_misc: reject a flag character as the field delimiter * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74486 - binfmt_misc: use exe_file_deny_write_access() for the interpreter clone * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74487 - binfmt_misc: restore write access when removing an entry * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74488 - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74490 - tipc: avoid use-after-free in poll trace queue dumps * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74491 - of/address: Fix NULL bus dereference in of_pci_range_parser_one() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74492 - netfilter: ipset: do not update comments from kernel-side hash adds * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74493 - net/smc: fix socket use-after-free during link group termination * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74494 - ksmbd: reject repeated SMB2 NEGOTIATE requests * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74495 - igbvf: Fix leak in TX DMA error cleanup * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74497 - ALSA: usb-audio: Clamp frame size in implicit-feedback mode * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74498 - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74499 - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74500 - ALSA: usb-audio: fix stack info leak in RME Digiface status * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74501 - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74502 - ALSA: ump: fix double free of out_cvts on rawmidi error * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74503 - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74504 - ALSA: seq: Fix division by zero in initialize_timer() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74505 - ALSA: 6fire: Fix UAF at error handling during probe * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74506 - afs: Fix UAF when sending a message * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74507 - Bluetooth: HIDP: validate numbered report payloads * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74508 - Bluetooth: HIDP: reject frames without a transaction header * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74509 - Bluetooth: hci_sync: Fix advertising data UAFs * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74510 - Bluetooth: mgmt: fix UAF in pair command cancellation * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74511 - Bluetooth: mgmt: fix pending command UAF in EIR updates * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74512 - audit: fix potential use-after-free in audit_del_rule() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74513 - dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74514 - KVM: s390: pci: Fix memory accounting for pinned/unpinned pages * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74515 - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74516 - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74518 - mm/hugetlb: fix list corruption in allocate_file_region_entries() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74519 - pinctrl: devicetree: don't free uninitialized dev_name on error path * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74520 - iommu/iommufd: Fix IOPF group ownership UAF * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74522 - ksmbd: fix use-after-free in __close_file_table_ids() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74523 - qede: sync udp_tunnel ports outside qede_lock in the recovery path * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74524 - riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74525 - net: sxgbe: free TX rings on RX allocation failure * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74531 - Bluetooth: hci_conn: hold conn reference in abort_conn_sync() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74532 - Bluetooth: btintel: Validate length before parsing diagnostics TLV * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74534 - Bluetooth: ISO: fix refcounting of iso_conn * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74535 - Bluetooth: ISO: avoid deadlocks in iso_sock_timeout * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74536 - Bluetooth: ISO: fix leaking sk after socket release * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74537 - Bluetooth: ISO: hold sk properly in iso_conn_ready * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74538 - Bluetooth: ISO: lock sk in iso_connect_ind * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74539 - Bluetooth: ISO: lock sk in iso_sock_getname * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74540 - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74541 - Bluetooth: ISO: clear iso_data always when detaching conn from hcon * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74543 - net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74545 - rtase: fix double free of multi-frag skb on DMA map failure * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74546 - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74547 - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74548 - forcedeth: fix UAF of txrx_stats in nv_remove * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74549 - hwmon: (nct6775-core) Prevent access to unsupported weight registers * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74550 - net: do not send ICMP/NDISC Redirects when peer allocation fails * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74551 - hwmon: (nzxt-smart2) DMA-align output buffer * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74552 - hwmon: (lm90) Only report alarms if driver is ready * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74553 - hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74555 - scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74556 - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74557 - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74559 - xsk: drain continuation descs after overflow in xsk_build_skb() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74560 - xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74563 - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74579 - netfilter: nft_payload: fix mask build for partial field offload * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74564 - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74565 - netfilter: nf_tables: make nft_object rhltable per table * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74566 - keys: make keyring key-chunk byte order agree with keyring_diff_objects() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74567 - keys: fix out-of-bounds read in keyring_get_key_chunk() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74569 - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74572 - btrfs: zoned: fix deadlock between metadata writeback and transaction commit * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74573 - iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74574 - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74575 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74576 - mm/slab: prevent unbounded recursion in free path with new kmalloc type * Resolute update: upstream stable patchset 2026-08-31 (LP: #2165942) // CVE-2026-74577 - net: mpls: initialize rtm_tos in mpls_getroute() -- Stefan Bader <stefan.bader@canonical.com> Fri, 23 Oct 2026 13:56:57 +0200 ** Changed in: linux (Ubuntu Resolute) Status: Fix Committed => Fix Released ** CVE added: https://cve.org/CVERecord?id=CVE-2024-50169 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-68305 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-68451 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-68452 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-68453 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-72404 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-72497 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74440 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74441 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74442 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74443 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74444 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74445 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74446 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74447 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74448 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74449 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74450 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74451 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74452 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74453 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74454 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74455 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74456 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74457 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74458 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74459 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74460 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74461 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74462 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74463 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74464 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74465 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74466 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74467 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74468 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74469 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74470 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74471 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74472 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74473 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74474 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74475 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74476 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74477 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74478 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74479 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74480 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74481 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74482 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74483 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74484 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74485 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74486 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74487 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74488 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74490 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74491 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74492 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74493 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74494 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74495 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74496 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74497 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74498 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74499 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74500 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74501 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74502 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74503 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74504 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74505 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74506 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74507 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74508 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74509 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74510 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74511 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74512 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74513 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74514 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74515 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74516 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74517 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74518 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74519 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74520 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74521 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74522 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74523 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74524 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74525 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74526 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74527 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74528 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74529 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74530 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74531 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74532 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74533 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74534 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74535 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74536 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74537 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74538 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74539 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74540 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74541 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74542 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74543 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74544 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74545 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74546 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74547 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74548 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74549 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74550 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74551 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74552 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74553 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74554 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74555 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74556 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74557 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74558 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74559 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74560 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74561 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74562 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74563 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74564 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74565 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74566 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74567 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74568 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74569 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74571 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74572 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74573 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74574 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74575 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74576 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74577 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74579 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74580 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74582 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74583 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74585 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74586 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74587 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74588 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74589 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74590 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74591 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74592 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74593 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74594 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74595 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74596 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74597 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74598 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74599 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74600 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74601 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74602 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74603 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74604 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74605 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74606 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74607 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74608 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74609 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74610 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74611 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74612 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74613 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74614 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74615 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74616 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74617 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74618 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74619 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74620 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74621 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74622 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74623 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74624 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74625 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74626 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74627 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74628 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74629 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74630 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74631 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74632 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74633 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74634 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74635 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74636 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74637 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74638 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74639 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74640 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74641 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74643 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74644 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74645 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74646 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74647 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74648 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74649 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74650 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74651 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74652 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74653 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74654 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74655 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74656 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74657 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74658 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74659 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74660 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74661 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74662 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74663 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74664 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74665 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74666 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74667 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74668 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74669 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74670 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74671 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74672 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74673 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74674 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74675 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74676 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74677 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74678 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74679 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74680 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74681 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74682 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74683 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74684 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74685 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74686 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74687 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74688 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74689 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74690 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74691 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74692 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74693 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74694 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74695 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74696 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74697 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74698 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74699 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74700 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74701 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74702 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74703 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74704 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74705 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74706 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74707 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74708 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74709 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74710 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74711 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74712 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74713 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74714 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74715 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74716 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74717 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74718 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74719 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74720 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74721 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74722 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74723 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74724 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74725 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74726 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74727 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74728 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74729 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74730 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74733 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74734 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74735 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74736 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74737 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74738 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74739 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74740 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74741 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74742 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74743 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74744 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74745 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74746 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74747 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74748 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74750 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74752 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74753 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-74754 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80519 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80520 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80521 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80522 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80523 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80524 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80525 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80526 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80527 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80528 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80529 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80530 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80531 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80532 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80533 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80534 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80535 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80536 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80537 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80538 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80539 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80540 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80541 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80542 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80547 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80548 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80549 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80550 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80551 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80552 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80553 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80554 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80555 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80556 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80557 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80558 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80559 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80560 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80561 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80562 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80563 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80564 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80565 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80566 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80567 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80568 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80569 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80570 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80571 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80572 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80573 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80574 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80575 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80576 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80577 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80578 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80579 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80580 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80581 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80582 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80583 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80584 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80585 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80586 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80587 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80588 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80589 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80590 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80724 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80833 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80834 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80857 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80858 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80859 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80860 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80914 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80925 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-80926 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89520 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89568 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89709 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89764 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89775 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89776 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89777 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89778 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89779 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89780 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89781 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89782 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89783 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89784 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89785 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89786 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89787 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89788 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89789 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89790 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89791 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89792 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89793 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89794 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89795 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89796 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89797 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89798 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89799 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89800 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89801 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89802 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89803 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89804 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89806 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89807 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89808 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89809 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89810 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89811 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89812 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89813 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89814 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89815 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89816 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89817 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89818 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89819 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89820 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89821 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89822 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89823 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89824 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89825 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89826 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89827 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89828 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89829 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89830 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89831 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89832 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89833 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89834 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89835 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89836 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89837 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89838 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89839 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89840 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89841 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89842 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89843 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89844 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89845 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89846 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89847 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89848 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89849 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89850 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89851 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89852 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89853 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89854 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89855 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89856 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89857 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89858 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89859 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89860 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89861 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89862 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89863 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89864 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89865 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89866 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89867 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89868 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89869 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89870 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89871 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89872 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89873 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89874 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89875 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89876 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89877 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89878 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89879 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89880 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89881 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89882 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89883 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89884 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89885 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89886 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89887 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89888 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89889 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89890 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89891 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89892 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89893 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89894 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89895 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89896 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89897 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89898 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89899 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89901 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89902 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89903 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89904 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89905 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89906 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89907 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89908 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89909 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89911 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89912 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89913 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89914 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89915 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89916 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89917 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89918 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89919 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89920 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89921 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89922 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89923 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89924 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89925 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89926 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89927 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89928 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89929 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89930 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89931 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89932 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89933 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89934 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89935 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89936 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89937 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89938 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89939 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89940 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89941 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89942 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89943 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89944 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89945 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89946 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89947 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89948 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89949 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89950 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89951 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89952 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89953 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89954 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89955 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89956 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89957 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89958 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89959 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89960 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89961 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89962 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89963 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89964 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89965 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89966 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89967 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89968 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89969 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89970 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89971 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89972 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89973 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89974 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89975 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89976 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89977 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89978 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89979 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89980 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89981 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89982 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89983 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89984 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89986 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89987 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89988 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89989 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89990 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89991 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89992 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89993 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89994 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89995 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89996 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89997 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89998 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-89999 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90000 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90001 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90002 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90003 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90005 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90006 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90007 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90011 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90012 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90013 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90014 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90015 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90016 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90017 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90018 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90019 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90020 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90021 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90022 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90023 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90024 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90025 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90026 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90027 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90028 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90029 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90030 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90031 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90032 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90033 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90034 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90035 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90036 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90037 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90039 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90040 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90041 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90042 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90043 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90044 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90045 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90046 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90047 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90048 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90049 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90051 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90053 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90054 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90055 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90056 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90057 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90058 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90059 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90060 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90061 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90062 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90063 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90065 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90066 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90067 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90068 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90069 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90070 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90071 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90072 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90073 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90074 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90075 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90076 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90077 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90078 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90079 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90080 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90081 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90082 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90083 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90084 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90085 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90086 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90087 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90088 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90089 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90090 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90091 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90092 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90093 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90094 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90095 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90097 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90099 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90100 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90101 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90102 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90103 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90104 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90105 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90106 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90107 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90108 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90109 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90110 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90111 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90112 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90113 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90114 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90115 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90116 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90119 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90120 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90121 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90122 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90124 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90125 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90126 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90127 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90128 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90129 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90130 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90135 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90136 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90137 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90138 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90139 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90140 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90141 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90142 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90143 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90144 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90145 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90146 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90147 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90148 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90149 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90150 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90151 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90152 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90153 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90154 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90155 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90156 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90157 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90158 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90159 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90160 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90161 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90162 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90163 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90164 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90165 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90166 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90167 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90169 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90170 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90174 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90175 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90176 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90177 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90178 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90179 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90180 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90182 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90183 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90184 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90185 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90186 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90187 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90188 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90189 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90190 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90191 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90192 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90193 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90194 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90195 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90196 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90197 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90198 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90199 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90200 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90201 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90202 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90203 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90204 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90205 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90206 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90207 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90208 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90209 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90211 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90212 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90213 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90214 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90215 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90216 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90217 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90218 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90219 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90220 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90221 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90222 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90223 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90224 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90225 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90226 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90227 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90228 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90229 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90230 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90231 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90232 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90233 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90234 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90235 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90237 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90240 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90241 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90242 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90243 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90244 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90245 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90246 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90247 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90248 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90249 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90250 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90251 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90252 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90253 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90254 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90255 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90256 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90257 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90258 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90259 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90260 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90261 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90262 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90263 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90264 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90265 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90267 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90269 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90270 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90271 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90272 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90273 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90274 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90275 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90276 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90277 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90278 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90279 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90280 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90281 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90282 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90283 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90284 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90285 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90286 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90287 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90288 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90289 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90290 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90291 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90292 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90293 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90294 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90295 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90296 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90297 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90298 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90300 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90301 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90302 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90303 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90306 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90307 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90308 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90309 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90310 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90311 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90312 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90313 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90314 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90315 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90316 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90317 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90318 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90319 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90320 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90321 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90322 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90323 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90324 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90325 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90326 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90327 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90328 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90329 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90330 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90331 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90332 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90333 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90334 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90335 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90336 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90337 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90338 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90341 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90342 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90343 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90344 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90345 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90346 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90347 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90348 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90349 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90350 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90351 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90352 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90353 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90354 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90355 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90356 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90357 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90358 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90359 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90360 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90361 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90362 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90363 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90364 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90365 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90366 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90367 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90368 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90369 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90370 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90371 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90372 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90373 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90374 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90375 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90376 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90377 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90378 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90379 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90380 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90381 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90382 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90383 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90384 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90385 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90386 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90387 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90388 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90389 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90390 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90391 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90392 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90393 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90394 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90395 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90396 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90397 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90398 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90399 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90400 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90401 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90402 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90403 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90404 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90406 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90407 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90408 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90409 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90410 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90411 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90412 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90413 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90414 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90415 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90416 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90417 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90418 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90419 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90420 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90421 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90422 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90423 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90424 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90425 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90426 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90427 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90428 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90429 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90430 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90431 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90433 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90434 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90435 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92476 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92477 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92479 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92480 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92481 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92482 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92483 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92484 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92485 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92486 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92488 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92489 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92490 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92491 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92493 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92494 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92495 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92496 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92497 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92498 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92499 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92500 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92501 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92503 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92504 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92505 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92506 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92507 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92508 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92509 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92510 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92511 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92512 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92513 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92514 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92515 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92516 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92517 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92518 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92519 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92520 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92521 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92522 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92523 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92524 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-92525 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93037 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93039 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93040 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93041 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93042 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93043 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93044 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93045 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93046 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93047 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93048 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93049 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93050 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93051 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93052 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93053 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93054 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93055 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93056 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93058 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93059 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93061 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93062 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93063 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93064 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93065 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93066 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93067 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93068 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93069 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93070 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93071 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93072 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93073 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93077 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93078 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93079 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93080 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93081 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93082 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93083 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93084 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93085 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93086 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93089 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93090 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93091 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93092 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93093 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93094 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93095 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93096 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93097 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93098 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93099 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93100 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93101 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93102 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93103 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93104 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93105 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93106 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93107 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93108 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93109 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93110 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93112 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93113 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93114 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93115 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93116 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93117 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93118 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93119 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93120 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93121 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93122 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93123 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93125 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93126 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93127 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93128 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93129 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93130 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93131 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93132 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93133 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93134 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93135 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93136 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93137 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93138 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93140 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93141 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93142 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93143 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93144 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93145 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93146 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93148 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93149 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93150 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93151 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93152 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93153 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93154 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93155 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93156 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93157 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93158 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93159 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93160 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93161 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93162 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93163 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93164 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93165 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93167 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93168 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93169 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93170 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93172 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93173 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93174 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93175 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93176 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93177 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93178 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93179 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93181 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93182 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93183 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93184 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93185 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93186 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93188 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93189 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93190 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93191 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93192 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93193 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93194 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93195 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93196 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93198 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93199 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93200 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93201 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93202 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93203 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93204 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98038 ** CVE added: https://cve.org/CVERecord?id=CVE-2026-98163 -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2171601 Title: Resolute update: upstream stable patchset 2026-10-21 Status in linux package in Ubuntu: Invalid Status in linux source package in Resolute: Fix Released Bug description: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-10-21 Ported from the following upstream stable releases: v6.18.57, v7.2.11 from git://git.kernel.org/ bnxt_en: fix DMA mapping length for padded small packets fs: Free any excess xarray nodes in clear_inode() net/mlx5e: Prevent stale XSK buffer release on refill retry net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() net: mana: Skip WQ object destruction for uninitialized RXQ accel/amdxdna: Bound the sync_bo flush range to the BO size net: dsa: mt7530: fix .get_stats64 sleeping in atomic context ipv6: Fix redirect exception creation for UDP/RAW sockets ipv4: validate checksum_start before completing checksum rust_binder: reschedule node refcount update on thread exit ipv4: stop PMTU walk when nexthop group shrinks ipv4: stop exception dump when nexthop group shrinks ipv4: stop route notification sizing when nexthop group shrinks ipv4: do not warn on route notification size race ipv6: do not warn on route notification size race Input: ati_remote2 - fix type confusion in device attribute handlers Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox Input: xpad - add support for Corsair Novablade Pro ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers ALSA: hda/tas2781: Accept V1 calibration data without CRC arm64: irq: exclude the softirq stack switch from KCOV ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() cipso: adjust cached option offsets when removing CIPSO dm ioctl: don't let data_start run past the buffer usb: f81604: fix struct f81604_int_data size mismatch vsock/virtio: account only unread bytes in read_skb() wifi: brcmfmac: fix P2P device removal race in brcmf_detach() wifi: mt76: mt7603: initialize global station WCID wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init() wireguard: queueing: preserve tstamp_type when encapsulating packet wireguard: noise: reject response consumption after intermediate initiation workqueue: Fix NULL current_pwq deref in chained work check xen/netfront: don't leak the skb when xennet_fill_frags() fails tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() strparser: make sure __strp_recv isn't running before tearing down the parser swiotlb: fix default_swiotlb_limit() for non-growable default pool tcp: reject net_iov in zerocopy receive mapping hints tipc: destroy topsrv workqueues before closing connections tipc: hold a reference to nodes found by link name Revert "wifi: libertas: reject short monitor TX frames" selinux: fix data race on AVC latest_notif selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute EDAC/amd64: Mask UMC chip select to the four implemented selects gpio: mpsse: fix race when arming the IRQ poll worker gpio: xilinx: fix runtime PM leak on request error path gve: fix napi_disable deadlock when attempting to disable XSK pools gve: fix XSK buffer leak when rings are stopped gve: fix XSK buffer leak on error descriptor ibmveth: h_free logical LAN on open-fail after register ibmveth: fix TX LTB and filter unwind on open-fail ice: fix use-after-free in dynamic port cleanup ice: fix metadata_dst refcount handling on representor teardown keys: finalize persistent keyring timeout after link attempt KEYS: Fix add_key() race with keyring restriction memstick: core: wait for request completion before freeing card memstick: rtsx_usb_ms: complete requests after eject instead of dropping them mm: don't schedule deferred kernel page table freeing while booting dm-crypt: reject the lmk IV mode with AEAD ciphers dm-integrity: fix buffer overflow in inline mode with large tag size dm-snap: reject the transient exception store for snapshot-merge dm: fix reading free memory in do_resume mmc: cavium-octeon: destroy slot platform devices on remove mmc: cavium-thunderx: destroy slot platform devices on remove mmc: mtk-sd: Cancel request timeout work on remove mmc: sdhci-sprd: disable runtime PM on remove net/packet: guard the ll header push in packet_rcv_spkt() net/smc: protect clcsock lifetime in smc_getname net: bridge: avoid recursive multicast port cleanup net: dsa: microchip: fix KSZ8765 fiber detection net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() net: sparx5: free the matchall entry on destroy net: usb: ax88179_178a: fix rx frame length for non-last packets net: team: stop reusing skb after queue override net: team: free skb when broadcast has no txable port nvme: fix swapped ZRASF zone state values for full and read only openvswitch: fix soft lockup in the netlink flow dump optee: register TEE devices only once fully initialized regulator: ltc3676: don't read the write-only HRST and CLIRQ registers regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains pmdomain: rockchip: don't ignore clock lookup errors on attach pmdomain: rockchip: fix clock leak on domain probe failure pmdomain: rockchip: propagate subdomain add errors scsi: qedi: Initialize callback state before registration riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE riscv: fix load_unaligned_zeropad() fixup for RV32 riscv: futex: untag the user pointer before the atomic access riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header Bluetooth: btintel_pcie: use managed IRQ teardown Bluetooth: hci_sock: Serialize dead-device detachment Bluetooth: hci_sync: Fix command skb lifetime during scan setup Bluetooth: ISO: Reject concurrent BIS listener setup Bluetooth: ISO: Serialize concurrent connect calls Bluetooth: MGMT: Fix status of pending commands flushed on power off Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() Bluetooth: RFCOMM: free the skb when the DLC has no owner Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN drm/gud: don't keep a connector without a CRTC as connector_state drm/i915/gem: Prevent overstepping exec array boundary drm/i915/gt: Unmask interrupts only when ACTIVE is true drm/imagination: Size page table preallocation by device address drm/vc4: drain the hangcheck timer and works on V3D unbind drm/vc4: Fix firmware reference leak in vc4_drm_bind() drm/vmwgfx: validate pitch coming from userspace drm/xe: Fix shrinker accounting double-subtraction on nested external pins drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin drm/amdkfd: align SDMA doorbell base for shader doorbell writes drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info drm/amdgpu: serialize vblank counter reads against GPU reset drm/amdgpu: make Mac FB workaround generic drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks drm/amdgpu/userq: only accept doorbell BOs as queue doorbell drm/amdgpu/userq: return the memdup_user() error for the user MQD drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs mount: keep a copied mount unbindable fs: don't silently unmount busy mounts namespace: reset the old parent's ->overmount in mnt_change_mountpoint() namespace: don't inherit MNT_UMOUNT in clone_mnt() namespace: don't copy an unmounted mount tree fs: refuse fspick() on internal superblocks namespace: check the target before walking it in do_mount_setattr() namespace: queue a mount only once for mount notifications namespace: check a submount for references right before unmounting it namespace: check a recursive bind mount for mount namespace loops namespace: look at the topmost mount for a mount namespace file namespace: remove the fsnotify marks of a mount namespace in process context namespace: check the mounts before reading their parents in pivot_root() dcache: don't put a mountpoint on a dentry that's being removed namespace: don't let a pseudo dentry become the root of a mount namespace: unhash a dentry before detaching the mounts on it namei: don't reveal overmounted entries in refwalk fcntl: refuse F_SET_RW_HINT on an immutable inode namespace: refuse an automount below a mount that is in no namespace namespace: never expire a locked mount namespace: handle mount locking for automounts correctly ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands accel/amdxdna: Fix NULL pointer dereference of mgmt_chann drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() RDMA/bnxt_re: Add a max slot check for SQ netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code s390/zcrypt: Close speculative mem read possibility octeontx2-af: Block VFs from clobbering special CGX PKIND state KVM: arm64: vgic: Fix race between LPI release and re-registration drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length NTB: core: Add .get_dma_dev() callback to ntb_dev_ops NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers svcrdma: Add Write chunk WRs to the RPC's Send WR chain svcrdma: wake sq waiters when the transport closes kho: fix size calculation in kho_preserved_memory_reserve() lockd, nfsd: RCU-protect nlmsvc_ops dispatch LoongArch: KVM: Validate MSI data before routing it to EIOINTC dpll: fix NULL deref in dpll_device_ops() during teardown race ksmbd: detach blocked lock requests before freeing ksmbd: defer publishing granted locks to prevent UAF/double-free race ksmbd: serialize oplock close with pending break ownership blk-cgroup: delay freeing policy data after rcu grace period PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers bpf: Invalidate RCU pointers after final spin unlock drm/amd/display: Fix dangling pointer in CRTC reset function bpf: Keep refcount_acquire nullable for borrowed RCU kptrs ring-buffer: Skip invalid sub-buffers when validating persistent ring buffer ipv6: mcast: annotate data-races around mca_users arm64: dts: lx2160a: fix incorrect pinmux arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount fs: don't let a migrating task hide its reference from do_umount() Bluetooth: btintel_pcie: fix TX descriptor bounds check Bluetooth: btintel_pcie: Add shared HW reset for clean start drm/dp: don't mark the AUX backlight enabled when enabling failed gpio: exar: initialize the ID before registering its cleanup drm/aspeed: Balance the display clock enable on teardown drm/vc4: Free the BO cache size list on teardown net/sched: em_text: reject unterminated algo before autoload amt: send the relay's General Query directly from the receive path cxgb4/ch_ktls: disable softirqs around tid_list erases tee: optee: fix kernel-doc warnings tee: optee: ffa: support shared memory offsets on large-page kernels ice: Restore Ordered MMIO Writes for Tx Doorbells nvmet: return Invalid Field for invalid NSIDs feature 82h nvmet: use the local P2P device on metadata allocation failure arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3 zloop: zero out only the unread tail of short reads btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio btrfs: free iov when btrfs_uring_read_extent() fails btrfs: unlock inode and extent in caller when io_uring read extent fails btrfs: fix xattr replace when multiple xattrs are packed in the same item btrfs: fix lost error return value in btrfs_listxattr() drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums net: make dev_xdp_sb_prog_count() see programs attached through a link riscv: vector: Fix data pointer constraints in context save/restore riscv: vector: Fix output operands in context save wifi: mt76: don't return TXQ when exceeding max non-AQL packets wifi: mac80211: add AQL support for multicast packets wifi: mac80211: add ieee80211_txq_aql_pending() wifi: mt76: add PS buffering support for HW-managed TIM drivers wifi: mt76: account non-AQL frames per peer rather than per link wifi: mt76: route nullfunc frames to PSD/ALTX queue wifi: mt76: use ALTX queue for packets to disassociated stations wifi: mt76: mt7925: restore the legacy BSS after MLO teardown wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout wifi: mt76: mt7915: disable rx napi when removing device wifi: mt76: mt7925: don't put the band auto marker in TGID wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit wifi: mt76: mt792x: pick the SAR table layout from the table itself Revert "wifi: ath12k: add panic handler" ASoC: adau1372: allow sleepy powerdown GPIOs ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM spi: sg2044-nor: Return transfer errors spi: sg2044-nor: Honor SPI clock limits cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug() flow_dissector: avoid u16 truncation of skb->len when computing thoff net: sparx5: start the TOD counters on non-PTP lan969x variants devlink: fix devlink_rel reference leak when notify work is pending net/sched: cls_route: reject change with no routing attribute Revert "net/mlx5: E-Switch, preserve max tx speed on vport state modification" net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET pfcp: make sure the SEID is linear before reading it bnxt_en: Add bnxt_clear_bars() helper bnxt_en: Fix driver init in kdump kernel bnxt_en: Delay for 5 seconds after AER DPC for all chips bnxt_en: Drop pci_save_state() after pci_restore_state() bnxt_en: Re-write the BARs following any type of PCIe errors flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() drm/imagination: Fix reference and vm_bo handling in remap() veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down net/mlx5e: Order ICOSQ cc update after CQ doorbell mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() ptp: ocp: fix PCIe delay estimation calculation net: openvswitch: validate transport header presence in set_ipv6_addr vsock: Fix memory leak in vmci_transport_recv_dgram_cb() drm/vc4: Fix binner slot allocation failing on an idle GPU x86/CPU/AMD: Fix AMD TLBI Erratum #1718 drm/panthor: validate userspace queue count against initialized firmware slot count s390/zcrypt: Improve CCA CPRB length and overflow checks s390/zcrypt: Improve EP11 CPRB length and overflow checks s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing s390/zcrypt: Pad trailing CCA or EP11 message with zeros xfs: remove duplicate INO1_WRITTEN check xfs: stop exchanging reflink flags when exchanging mappings xfs: fix exchange-range-to-eof file size exchange can: fix unique skb identifier regression under RPS SUNRPC: Add Kconfig dependency on CRYPTO_KRB5 regulator: of: fill in supply names in of_regulator_bulk_get_all() drm/amd/display: Don't replace a sink mode that shares the native totals sched_ext: Generate qseq from a per-task counter HID: steam: Fully unregister controller when hidraw is opened HID: steam: Rearrange teardown sequence HID: steam: Refactor registration HID: steam: Clean up locking ipv4: udp: Create exceptions before socket matching ipv6: udp: Create exceptions before socket matching can: dev: init_can_skb(): restore skb header initialization e1000e: add system to disable K1 list fsverity: RCU-delay the freeing of struct fsverity_info iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test iavf: send MAC change request synchronously io_uring/register: don't exempt disabled rings from task restrictions ip6_tunnel: do not use dst6_mtu() in ip4ip6_err() and ip6erspan_tunnel_xmit() ip6_gre: remove obsolete ERSPAN PMTU update mm/vma: introduce vma_test[_any[_mask]](), and make inlining consistent mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all() scsi: ch: Do not keep references to data transfer element devices scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ riscv: patch: fix handling of bpf-jit execmem addresses riscv: ptrace: reject CFI regset access when extensions are absent Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex drm/xe/i2c: cancel the client work on remove drm/amd/display: disable self-refresh on tearing flips statmount: read the parent of an unmounted mount under mount_lock namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE namespace: don't reconfigure internal superblocks via remount and umount unshare: don't drop active namespace references that were never taken nullfs: don't update the access time clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys scsi: ufs: core: Hold a clock reference across the probe drm/bridge: Fix unlocked list_del in drm_bridge_add() drm/bridge: Fix unlocked list access in drm_bridge_attach() cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() drm/vc4: Use kvmalloc_objs() for the BO cache size list lib/dim: fix 32-bit overflow in dim_calc_stats() rates net: stmmac: propagate PTP addend and system time programming errors bonding: fix the program leak when XDP is replaced btrfs: don't stash io_uring encoded data across -EAGAIN drm/xe: Do not emit Wa_16010904313 twice net/mlx5: Lag, split aggregate speed into oper and max helpers net: stmmac: Do not advertise S-VLAN stripping when it is disabled net: stmmac: Disable S-Tag processing on dwmac4 net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param() Revert "net: stmmac: propagate PTP addend and system time programming errors" scsi: ufs: mediatek: Handle mPHY power-on failures net: always dissect GSO packets in __virtio_net_hdr_to_skb() ASoC: sdw_utils: Add codec info for CS35L62 ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI riscv: ptrace: Zero-initialize regset buffers before copyin bareudp: set the inner protocol to the protocol of the packet net/packet: call packet_parse_headers after virtio_net_hdr_to_skb drm/vc4: Use devm_request_irq() for automatic cleanup drm/vc4: Disable the V3D interrupt across runtime suspend io_uring/memmap: account the pages a compound region really uses io_uring/zcrx: use better name for RQ region io_uring: cast id to u64 before shifting in io_allocate_rbuf_ring() io_uring/zcrx: use correct mmap off constants io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge UBUNTU: Upstream stable to v6.18.57, v7.2.11 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171601/+subscriptions
