Public bug reported: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-05-01 Ported from the following upstream stable releases: v6.6.128, v6.12.75 from git://git.kernel.org/ RDMA/siw: Fix potential NULL pointer dereference in header processing RDMA/umad: Reject negative data_len in ib_umad_write auxdisplay: arm-charlcd: fix release_mem_region() size hfsplus: return error when node already exists in hfs_bnode_create rcu: s/boost_kthread_mutex/kthread_mutex rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() rcu: Refactor expedited handling check in rcu_read_unlock_special() rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() rcu: Fix rcu_read_unlock() deadloop due to softirq audit: move the compat_xxx_class[] extern declarations to audit_arch.h i3c: Move device name assignment after i3c_bus_init fs: add <linux/init_task.h> for 'init_fs' i3c: master: Update hot-join flag only on success gfs2: Retries missing in gfs2_{rename,exchange} gfs2: Fix use-after-free in iomap inline data write path i3c: dw: Initialize spinlock to avoid upsetting lockdep tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure tpm: st33zp24: Fix missing cleanup on get_burstcount() error btrfs: qgroup: return correct error when deleting qgroup relation item btrfs: fix block_group_tree dirty_list corruption smb: client: fix potential UAF and double free in smb2_open_file() xen/virtio: Don't use grant-dma-ops when running as Dom0 ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() io_uring/sync: validate passed in offset cpuidle: menu: Cleanup after loadavg removal cpuidle: governors: menu: Always check timers with tick stopped md/raid10: fix any_working flag handling in raid10_sync_request iomap: fix submission side handling of completion side errors ublk: Validate SQE128 flag before accessing the cmd x86/xen: make some functions static Partial revert "x86/xen: fix balloon target initialization for PVH dom0" PM: wakeup: Handle empty list in wakeup_sources_walk_start() perf: arm_spe: Properly set hw.state on failures PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races s390/cio: Fix device lifecycle handling in css_alloc_subchannel() crypto: qat - fix warning on adf_pfvf_pf_proto.c selftests/bpf: veristat: fix printing order in output_stats() libbpf: Fix OOB read in btf_dump_get_bitfield_value ARM: VDSO: Patch out __vdso_clock_getres() if unavailable crypto: cavium - fix dma_free_coherent() size crypto: octeontx - fix dma_free_coherent() size crypto: hisilicon/zip - adjust the way to obtain the req in the callback function crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable hrtimer: Fix trace oddity bpf, sockmap: Fix incorrect copied_seq calculation bpf, sockmap: Fix FIONREAD for sockmap crypto: hisilicon/trng - modifying the order of header files crypto: hisilicon/trng - support tfms sharing the device bpf: Fix bpf_xdp_store_bytes proto for read-only arg scsi: efct: Use IRQF_ONESHOT and default primary handler EDAC/altera: Remove IRQF_ONESHOT mfd: wm8350-core: Use IRQF_ONESHOT sched/rt: Skip currently executing CPU in rto_next_cpu() pstore/ram: fix buffer overflow in persistent_ram_save_old() soc: qcom: smem: handle ENOMEM error during probe EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings clk: qcom: Return correct error code in qcom_cc_probe_by_index() arm64: dts: qcom: sdm630: fix gpu_speed_bin size arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node arm64: dts: amlogic: axg: assign the MMC signal clocks arm64: dts: amlogic: gx: assign the MMC signal clocks arm64: dts: amlogic: g12: assign the MMC B and C signal clocks arm64: dts: amlogic: g12: assign the MMC A signal clock arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions workqueue: Factor out assign_rescuer_work() workqueue: Only assign rescuer work when really needed workqueue: Process rescuer work items one-by-one using a cursor smack: /smack/doi must be > 0 smack: /smack/doi: accept previously used values ASoC: nau8821: Consistently clear interrupts before unmasking ASoC: nau8821: Avoid unnecessary blocking in IRQ handler ASoC: nau8821: Fixup nau8821_enable_jack_detect() drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init drm/msm/disp/dpu: add merge3d support for sc7280 regulator: core: move supply check earlier in set_machine_constraints() HID: playstation: Add missing check for input_ff_create_memless drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x media: ccs: Accommodate C-PHY into the calculation drm/msm/a2xx: fix pixel shader start on A225 platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev media: uvcvideo: Fix allocation for small frame sizes platform/chrome: cros_ec_lightbar: Fix response size initialization spi: tools: Add include folder to .gitignore Revert "hwmon: (ibmpex) fix use-after-free in high/low store" PCI: mediatek: Fix IRQ domain leak when MSI allocation fails Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors PCI/PM: Avoid redundant delays on D3hot->D3cold PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails Documentation: tracing: Add ring-buffer mapping docs: fix WARNING document not included in any toctree Documentation: trace: Refactor toctree Documentation: tracing: Add PCI tracepoint documentation PCI: Do not attempt to set ExtTag for VFs PCI/portdrv: Fix potential resource leak quota: fix livelock between quotactl and freeze_super net: mctp-i2c: fix duplicate reception of old data mctp i2c: initialise event handler read bytes wifi: cfg80211: stop NAN and P2P in cfg80211_leave netfilter: nf_tables: reset table validation state on abort netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH netfilter: nf_conncount: increase the connection clean up limit to 64 netfilter: nft_compat: add more restrictions on netlink attributes netfilter: nf_conncount: fix tracking of connections from localhost module: add helper function for reading module_buildid() kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() PCI: Mark 3ware-9650SA Root Port Extended Tags as broken iommu/vt-d: Flush cache for PASID table before using it dm: use bio_clone_blkg_association nfsd: never defer requests during idmap lookup fat: avoid parent link count underflow in rmdir tcp: tcp_tx_timestamp() must look at the rtx queue wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() PCI: Initialize RCB from pci_configure_device() PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros PCI: Add defines for bridge window indexing PCI/ACPI: Restrict program_hpx_type2() to AER bits ipc: don't audit capability check in ipc_permissions() ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() mptcp: fix receive space timestamp initialization octeontx2-af: Fix PF driver crash with kexec kernel booting bonding: only set speed/duplex to unknown, if getting speed failed inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP nfc: hci: shdlc: Stop timers and work before freeing context netfilter: nft_set_hash: fix get operation on big endian netfilter: nft_counter: fix reset of counters on 32bit archs netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] net: hns3: fix double free issue for tx spare buffer procfs: fix missing RCU protection when reading real_parent in do_task_stat() smb: client: correct value for smbd_max_fragmented_recv_size net: atm: fix crash due to unvalidated vcc pointer in sigd_send() net: sunhme: Fix sbus regression net: Add skb_dstref_steal and skb_dstref_restore net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path serial: caif: fix use-after-free in caif_serial ldisc_close() octeon_ep: disable per ring interrupts octeon_ep: ensure dbell BADDR updation ionic: Rate limit unknown xcvr type messages octeontx2-pf: Unregister devlink on probe failure RDMA/rtrs: server: remove dead code IB/cache: update gid cache on client reregister event RDMA/hns: Fix WQ_MEM_RECLAIM warning RDMA/hns: Notify ULP of remaining soft-WCs during reset power: supply: ab8500: Fix use-after-free in power_supply_changed() power: supply: act8945a: Fix use-after-free in power_supply_changed() power: supply: bq256xx: Fix use-after-free in power_supply_changed() power: supply: bq25980: Fix use-after-free in power_supply_changed() power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() power: supply: goldfish: Fix use-after-free in power_supply_changed() power: supply: rt9455: Fix use-after-free in power_supply_changed() power: supply: sbs-battery: Fix use-after-free in power_supply_changed() power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write power: supply: bq27xxx: fix wrong errno when bus ops are unsupported power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() RDMA/rtrs-srv: fix SG mapping RDMA/rxe: Fix double free in rxe_srq_from_init tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper crypto: ccp - Add an S4 restore flow crypto: ccp - Factor out ring destroy handling to a helper crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send RDMA/rxe: Fix race condition in QP timer handlers svcrdma: Increase the per-transport rw_ctx count svcrdma: Reduce the number of rdma_rw contexts per-QP RDMA/core: add rdma_rw_max_sge() helper for SQ sizing cxl: Fix premature commit_end increment on decoder commit failure mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() mtd: spinand: Fix kernel doc power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() scsi: ufs: host: mediatek: Require CONFIG_PM scsi: csiostor: Fix dereference of null pointer rn nvdimm: virtio_pmem: serialize flush requests fs/nfs: Fix readdir slow-start regression tracing: Properly process error handling in event_hist_trigger_parse() tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs clk: qcom: rcg2: compute 2d using duty fraction directly clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc clk: qcom: gcc-ipq5018: flag sleep clock as critical clk: Move clk_{save,restore}_context() to COMMON_CLK section clk: qcom: dispcc-sdm845: Enable parents for pixel clocks clk: qcom: gfx3d: add parent to parent request map clk: mediatek: Fix error handling in runtime PM setup dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX dma: dma-axi-dmac: fix SW cyclic transfers staging: greybus: lights: avoid NULL deref serial: imx: change SERIAL_IMX_CONSOLE to bool serial: SH_SCI: improve "DMA support" prompt mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms iio: pressure: mprls0025pa: fix scan_type struct watchdog: starfive-wdt: Fix PM reference leak in probe error path coresight: etm3x: Fix cpulocked warning on cpuhp Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure mfd: simple-mfd-i2c: Add MAX77705 support mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA mfd: simple-mfd-i2c: Add SpacemiT P1 support mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order mfd: simple-mfd-i2c: Add Delta TN48M CPLD support UBUNTU: [Config] Disable new Delta TN48M CPLD support by default drivers: iio: mpu3050: use dev_err_probe for regulator request usb: bdc: fix sleep during atomic pinctrl: equilibrium: Fix device node reference leak in pinbank_init() ovl: Fix uninit-value in ovl_fill_real iio: sca3000: Fix a resource leak in sca3000_probe() pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition pinctrl: single: fix refcount leak in pcs_add_gpio_func() leds: qcom-lpg: Check the return value of regmap_bulk_write() backlight: qcom-wled: Support ovp values for PMI8994 backlight: qcom-wled: Change PM8950 WLED configurations dmaengine: fsl-edma: don't explicitly disable clocks in .remove() io_uring/cancel: de-unionize file and user_data in struct io_cancel_data fs/ntfs3: prevent infinite loops caused by the next valid being the same fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check kbuild: Add objtool to top-level clean target selftests/memfd: delete unused declarations selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO cpuidle: Skip governor when only one idle state is available selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 net: sparx5/lan969x: fix DWRR cost max to match hardware register width net: mscc: ocelot: extract ocelot_xmit_timestamp() helper net: mscc: ocelot: split xmit into FDMA and register injection paths net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() ipv6: Fix out-of-bound access in fib6_add_rt2node(). net: sparx5/lan969x: fix PTP clock max_adj value net: usb: catc: enable basic endpoint checking xen-netback: reject zero-queue configuration from guest net/rds: rds_sendmsg should not discard payload_len net: bridge: mcast: always update mdb_n_entries for vlan contexts selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled netfilter: nf_conntrack_h323: don't pass uninitialised l3num value net: remove WARN_ON_ONCE when accessing forward path array netfilter: nf_tables: fix use-after-free in nf_tables_addchain() ipv6: fix a race in ip6_sock_set_v6only() bpftool: Fix truncated netlink dumps ping: annotate data-races in ping_lookup() macvlan: observe an RCU grace period in macvlan_common_newlink() error path icmp: move icmp_global.credit and icmp_global.stamp to per netns storage icmp: icmp_msgs_per_sec and icmp_msgs_burst sysctls become per netns icmp: prevent possible overflow in icmp_global_allow() cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) inet: move icmp_global_{credit,stamp} to a separate cache line octeontx2-af: Fix default entries mcam entry action bonding: alb: fix UAF in rlb_arp_recv during bond up/down net/mlx5: Fix multiport device check over light SFs apparmor: fix NULL sock in aa_sock_file_perm apparmor: return -ENOMEM in unpack_perms_table upon alloc failure apparmor: fix rlimit for posix cpu timers apparmor: remove apply_modes_to_perms from label_match apparmor: make label_match return a consistent value apparmor: fix invalid deref of rawdata when export_binary is unset apparmor: fix aa_label to return state from compount and component match drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() drm/amdgpu: Fix memory leak in amdgpu_ras_init() drm/i915/acpi: free _DSM package when no connectors ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init drm/amdkfd: fix debug watchpoints for logical devices drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() spi: wpcm-fiu: Fix uninitialized res spi: wpcm-fiu: Simplify with dev_err_probe() spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n efi: Fix reservation of unaccepted memory table btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found x86/hyperv: Fix error pointer dereference ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk drm/amd/display: Use same max plane scaling limits for all 64 bpp formats MIPS: Work around LLVM bug when gp is used as global register variable ext4: don't cache extent during splitting extent ext4: fix memory leak in ext4_ext_shift_extents() ext4: use optimized mballoc scanning regardless of inode format ata: pata_ftide010: Fix some DMA timings ata: libata-scsi: refactor ata_scsi_translate() SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names perf test stat: Update test expectations and events perf test stat tests: Fix for virtualized machines perf unwind-libdw: Fix invalid reference counts perf callchain: Fix srcline printing with inlines libsubcmd: Fix null intersection case in exclude_cmds() libperf: Don't remove -g when EXTRA_CFLAGS are used libperf build: Always place libperf includes first rtc: interface: Alarm race handling should not discard preceding error audit: add fchmodat2() to change attributes class hfsplus: fix volume corruption issue for generic/498 fs/buffer: add alert in try_to_free_buffers() for folios without buffers audit: add missing syscalls to read class hfsplus: pretend special inodes as regular files i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() minix: Add required sanity checking to minix_check_superblock() btrfs: handle user interrupt properly in btrfs_trim_fs() smb: client: add proper locking around ses->iface_last_update gfs2: fiemap page fault fix smb: client: prevent races in ->query_interfaces() tools/power cpupower: Reset errno before strtoull() s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS perf/arm-cmn: Support CMN-600AE arm64: Add support for TSV110 Spectre-BHB mitigation rnbd-srv: Zero the rsp buffer before using it x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set EFI/CPER: don't dump the entire memory region APEI/GHES: ensure that won't go past CPER allocated record EFI/CPER: don't go past the ARM processor CPER record buffer ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP md-cluster: fix NULL pointer dereference in process_metadata_update cpufreq: dt-platdev: Block the driver from probing on more QC platforms s390/perf: Disable register readout on sampling events perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD xenbus: Use .freeze/.thaw to handle xenbus devices blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() sparc: Synchronize user stack on fork and clone sparc: don't reference obsolete termio struct for TC* constants bpf: verifier improvement in 32bit shift sign extension pattern clocksource/drivers/sh_tmu: Always leave device running after probe clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF PCI/MSI: Unmap MSI-X region on error crypto: hisilicon/qm - move the barrier before writing to the mailbox register mailbox: bcm-ferxrm-mailbox: Use default primary handler char: tpm: cr50: Remove IRQF_ONESHOT pstore: ram_core: fix incorrect success return when vmap() fails arm64: tegra: smaug: Add usb-role-switch support parisc: Prevent interrupts during reboot drm/display/dp_mst: Add protection against 0 vcpi spi-geni-qcom: initialize mode related registers to 0 spi-geni-qcom: use xfer->bits_per_word for can_dma() media: dvb-core: dmxdevfilter must always flush bufs spi: stm32: fix Overrun issue at < 8bpw drm/v3d: Set DMA segment size to avoid debug warnings media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes media: omap3isp: isppreview: always clamp in preview_try_format() media: omap3isp: set initial format media: mediatek: vcodec: Don't try to decode 422/444 VP9 drm/amdgpu: add support for HDP IP version 6.1.1 drm/amdgpu: avoid a warning in timedout job handler HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug spi: spi-mem: Limit octal DTR constraints to octal DTR situations media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START media: adv7180: fix frame interval in progressive mode media: pvrusb2: fix URB leak in pvr2_send_request_ex media: solo6x10: Check for out of bounds chip_id media: cx25821: Fix a resource leak in cx25821_dev_setup() media: v4l2-async: Fix error handling on steps after finding a match drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() drm: Account property blob allocations to memcg hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed virt: vbox: uapi: Mark inner unions in packed structs as packed drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release media: rkisp1: Fix filter mode register configuration HID: multitouch: add eGalaxTouch EXC3188 support HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro gpio: aspeed-sgpio: Change the macro to support deferred probe ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE hwmon: (f71882fg) Add F81968 support ASoC: es8328: Add error unwind in resume modpost: Amend ppc64 save/restfpr symnames for -Os build ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio jfs: Add missing set_freezable() for freezable kthread jfs: nlink overflow in jfs_rename wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H dm: replace -EEXIST with -EBUSY dm: remove fake timeout to avoid leak request iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency wifi: libertas: fix WARNING in usb_tx_block iommu/amd: move wait_on_sem() out of spinlock wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 wifi: ath12k: fix preferred hardware mode calculation ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() ipv6: exthdrs: annotate data-race over multiple sysctl ext4: mark group add fast-commit ineligible ext4: move ext4_percpu_param_init() before ext4_mb_init() ext4: mark group extend fast-commit ineligible netfilter: nf_conntrack: Add allow_clash to generic protocol handler netfilter: xt_tcpmss: check remaining length before reading optlen openrisc: define arch-specific version of nop() net: usb: r8152: fix transmit queue timeout wifi: iwlwifi: mvm: check the validity of noa_len net/rds: No shortcut out of RDS_CONN_ERROR gro: change the BUG_ON() in gro_pull_from_frag0() ipv4: igmp: annotate data-races around idev->mr_maxdelay net: hns3: extend HCLGE_FD_AD_QID to 11 bits wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() ipv4: fib: Annotate access to struct fib_alias.fa_state. Bluetooth: hci_conn: Set link_policy on incoming ACL connections Bluetooth: hci_conn: use mod_delayed_work for active mode timeout Bluetooth: btusb: Add new VID/PID for RTL8852CE Bluetooth: btusb: Add device ID for Realtek RTL8761BU octeontx2-af: Workaround SQM/PSE stalls by disabling sticky wifi: rtw89: pci: restore LDO setting after device resume wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() net: usb: sr9700: remove code to drive nonexistent multicast filter vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 net/rds: Clear reconnect pending bit PCI: Mark ASM1164 SATA controller to avoid bus reset PCI: Fix pci_slot_lock () device locking PCI: Enable ACS after configuring IOMMU for OF platforms PCI: Add ACS quirk for Qualcomm Hamoa & Glymur PCI: Mark Nvidia GB10 to avoid bus reset myri10ge: avoid uninitialized variable use nfc: nxp-nci: remove interrupt trigger type RDMA/rtrs-clt: For conn rejection use actual err number ata: libata: avoid long timeouts on hot-unplugged SATA DAS hisi_acc_vfio_pci: update status after RAS error scsi: buslogic: Reduce stack usage vhost: fix caching attributes of MMIO regions by setting them explicitly tracing: Fix false sharing in hwlat get_sample() remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized mailbox: pcc: Remove spurious IRQF_ONESHOT usage mailbox: imx: Skip the suspend flag for i.MX7ULP mailbox: sprd: mask interrupts that are not handled remoteproc: mediatek: Break lock dependency to `prepare_lock` mailbox: sprd: clear delivery flag before handling TX done clk: microchip: core: correct return value on *_get_parent() m68k: nommu: fix memmove() with differently aligned src and dest for 68000 soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure serial: 8250_dw: handle clock enable errors in runtime_resume usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs fpga: of-fpga-region: Fail if any bridge is missing dmaengine: sun6i: Choose appropriate burst length under maxburst dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 staging: rtl8723bs: fix memory leak on failure path serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done fix it87_wdt early reboot by reporting running timer binder: don't use %pK through printk watchdog: imx7ulp_wdt: handle the nowayout option phy: mvebu-cp110-utmi: fix dr_mode property read from dts phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature Revert "mfd: da9052-spi: Change read-mask to write-mask" iio: Use IRQF_NO_THREAD iio: magnetometer: Remove IRQF_ONESHOT MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE fs: ntfs3: check return value of indx_find to avoid infinite loop fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST fs/ntfs3: drop preallocated clusters for sparse and compressed files fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() ceph: supply snapshot context in ceph_uninline_data() libceph: define and enforce CEPH_MAX_KEY_LEN thermal: int340x: Fix sysfs group leak on DLVR registration failure include: uapi: netfilter_bridge.h: Cover for musl libc ARM: 9467/1: mm: Don't use %pK through printk drm/amd/display: Avoid updating surface with the same surface under MPO drm/amdgpu: Adjust usleep_range in fence wait ALSA: usb-audio: Update the number of packets properly at receiving drm/amdgpu: Add HAINAN clock adjustment drm/radeon: Add HAINAN clock adjustment ALSA: usb-audio: Add sanity check for OOB writes at silencing btrfs: replace BUG() with error handling in __btrfs_balance() drm/amd/display: Remove conditional for shaper 3DLUT power-on rtc: zynqmp: correct frequency value ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut xfrm6: fix uninitialized saddr in xfrm6_get_saddr() xfrm: skip templates check for packet offload tunnel mode ipmi: ipmb: initialise event handler read bytes xfrm: always flush state and policy upon NETDEV_UNREGISTER event net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode net: usb: lan78xx: scan all MDIO addresses on LAN7801 net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() net: ethernet: xscale: Check for PTP support properly wifi: cfg80211: wext: fix IGTK key ID off-by-one Remove WARN_ALL_UNSEEDED_RANDOM kernel config option UBUNTU: [Config] Remove WARN_ALL_UNSEEDED_RANDOM Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ Bluetooth: hci_qca: Cleanup on all setup failures Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ tipc: fix duplicate publication key in tipc_service_insert_publ() RDMA/core: Fix stale RoCE GIDs during netdev events at registration net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets RDMA/efa: Fix typo in efa_alloc_mr() net: usb: pegasus: enable basic endpoint checking RDMA/umem: Fix double dma_buf_unpin in failure path net/mlx5: DR, Fix circular locking dependency in dump net/mlx5: Fix missing devlink lock in SRIOV enable error path net: consume xmit errors of GSO frames dpaa2-switch: validate num_ifs to prevent out-of-bounds write netfilter: nf_conntrack_h323: fix OOB read in decode_choice() rpmsg: core: fix race in driver_override_show() and use core helper clk: renesas: rzg2l: Fix intin variable size clk: renesas: rzg2l: Select correct div round macro ASoC: SOF: ipc4-control: If there is no data do not send bytes update ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data ASoC: SOF: ipc4-control: Keep the payload size up to date fpga: dfl: use subsys_initcall to allow built-in drivers to be added dm-verity: correctly handle dm_bufio_client_create() failure media: mediatek: encoder: Fix uninitialized scalar variable issue media: mtk-mdp: Fix error handling in probe function media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() media: verisilicon: AV1: Fix enable cdef computation media: verisilicon: AV1: Fix tx mode bit setting ARM: omap2: Fix reference count leaks in omap_control_init() KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding arm64: Disable branch profiling for all arm64 code HID: hid-pl: handle probe errors HID: magicmouse: Do not crash on missing msc->input HID: prodikeys: Check presence of pm->input_ep82 HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() arm64: dts: apple: t8112-j473: Keep the HDMI port powered on media: verisilicon: AV1: Set IDR flag for intra_only frame type media: radio-keene: fix memory leak in error path media: cx88: Add missing unmap in snd_cx88_hw_params() media: cx23885: Add missing unmap in snd_cx23885_hw_params() media: cx25821: Add missing unmap in snd_cx25821_hw_params() media: i2c/tw9903: Fix potential memory leak in tw9903_probe() media: i2c/tw9906: Fix potential memory leak in tw9906_probe() media: i2c: ov01a10: Fix the horizontal flip control media: i2c: ov01a10: Fix reported pixel-rate value media: i2c: ov01a10: Fix analogue gain range media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls media: i2c: ov01a10: Fix test-pattern disabling media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() media: ccs: Avoid possible division by zero media: i2c: ov5647: Initialize subdev before controls media: i2c: ov5647: Correct pixel array offset media: i2c: ov5647: Correct minimum VBLANK value media: i2c: ov5647: Sensor should report RAW color space media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode media: i2c: ov5647: use our own mutex for the ctrl lock dm-integrity: fix a typo in the code for write/discard race dm: clear cloned request bio pointer when last clone bio completes soc: ti: k3-socinfo: Fix regmap leak on probe failure soc: ti: pruss: Fix double free in pruss_clk_mux_setup() KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation clk: clk-apple-nco: Add "apple,t8103-nco" compatible media: i2c: ov01a10: Fix digital gain range clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() s390/pci: Handle futile config accesses of disabled devices directly dm-integrity: fix recalculation in bitmap mode dm-unstripe: fix mapping bug when there are multiple targets in a table arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro media: venus: vdec: fix error state assignment for zero bytesused media: venus: vdec: restrict EOS addr quirk to IRIS2 only drm: of: drm_of_panel_bridge_remove(): fix device_node leak mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs xfs: mark data structures corrupt on EIO and ENODATA media: verisilicon: AV1: Fix tile info buffer size iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode mfd: core: Add locking around 'mfd_of_node_list' xfs: delete attr leaf freemap entries when empty xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs: fix remote xattr valuelblk check KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions md/bitmap: fix GPF in write_page caused by resize race nfsd: fix return error code for nfsd_map_name_to_[ug]id nvmem: Drop OF node reference on nvmem_add_one_cell() failure usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN bus: fsl-mc: fix an error handling in fsl_mc_device_add() dm mpath: make pg_init_delay_msecs settable tools: Fix bitfield dependency failure powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() iio: gyro: itg3200: Fix unchecked return value in read_raw mm/highmem: fix __kmap_to_page() build error rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() ocfs2: fix reflink preserve cleanup issue kexec: derive purgatory entry from symbol Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" PCI/IOV: Fix race between SR-IOV enable/disable and hotplug arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y btrfs: continue trimming remaining devices on failure remoteproc: imx_rproc: Fix invalid loaded resource table detection perf/arm-cmn: Reject unsupported hardware configurations scsi: ufs: core: Flush exception handling work when RPM level is zero usb: dwc3: gadget: Move vbus draw to workqueue context usb: dwc2: fix resume failure if dr_mode is host mtd: rawnand: pl353: Fix software ECC support tipc: fix RCU dereference race in tipc_aead_users_dec() drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path PCI: Fix pci_slot_trylock() error handling parisc: kernel: replace kfree() with put_device() in create_tree_node() staging: rtl8723bs: fix null dereference in find_network cifs: Fix locking usage for tcon fields MIPS: rb532: Fix MMIO UART resource registration ceph: supply snapshot context in ceph_zero_partial_object() LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE LoongArch: Prefer top-down allocation after arch_mem_init() LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT LoongArch: Disable instrumentation for setup_ptwalker() net: ethernet: marvell: skge: remove incorrect conflicting PCI ID net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() octeontx2-af: CGX: fix bitmap leaks net: macb: Fix tx/rx malfunction after phy link down and up tracing: Fix to set write permission to per-cpu buffer_size_kb io_uring/filetable: clamp alloc_hint to the configured alloc range net: intel: fix PCI device ID conflict between i40e and ipw2200 atm: fore200e: fix use-after-free in tasklets during device removal ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() fbcon: check return value of con2fb_acquire_newinfo() fbdev: vt8500lcdfb: fix missing dma_free_coherent() fbdev: of: display_timing: fix refcount leak in of_get_display_timings() fbdev: ffb: fix corrupted video output on Sun FFB1 fbcon: Remove struct fbcon_display.inverse cifs: some missing initializations on replay ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() x86/kexec: Copy ACPI root pointer address from config table arm64: Force the use of CNTVCT_EL0 in __delay() net: nfc: nci: Fix parameter validation for packet data tracing: Fix checking of freed trace_event_file for hist files tracing: Wake up poll waiters for hist files when removing an event NTB: ntb_transport: Fix too small buffer for debugfs_name drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros arm64: Fix sampling the "stable" virtual counter in preemptible section gfs2: Fix slab-use-after-free in qd_put io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature OPP: Return correct value in dev_pm_opp_get_level cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() perf/x86/core: Do not set bit width for unavailable counters genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() media: pci: mg4b: Use IRQF_NO_THREAD firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) media: chips-media: wave5: Fix memory leak on codec_info allocation failure drm/amd: Drop "amdgpu kernel modesetting enabled" message drm/amdkfd: Fix signal_eviction_fence() bool return value drm/xe: Unregister drm device on probe error HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients wifi: cfg80211: Fix use_for flag update on BSS refresh PCI: Check parent for NULL in of_pci_bus_release_domain_nr() netfilter: nfnetlink_queue: optimize verdict lookup with hash table netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() RDMA/mlx5: Fix UMR hang in LAG error state unload IB/mlx5: Fix port speed query for representors platform/x86/amd/pmf: Prevent TEE errors after hibernate crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue iio: pressure: mprls0025pa: fix interrupt flag objpool: fix the overestimation of object pooling metadata size ipvs: do not keep dest_dst if dev is going down net/mlx5e: Use unsigned for mlx5e_get_max_num_channels AppArmor: Allow apparmor to handle unaligned dfa tables apparmor: Fix & Optimize table creation from possibly unaligned memory apparmor: avoid per-cpu hold underflow in aa_get_buffer drm/amd/display: Fix out-of-bounds stream encoder index v3 btrfs: use the correct type to initialize block reserve for delayed refs Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init APEI/GHES: ARM processor Error: don't go past allocated memory ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] powercap: intel_rapl: Add PL4 support for Ice Lake alpha: fix user-space corruption during memory compaction ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) ACPI: battery: fix incorrect charging status when current is zero perf/x86/msr: Add Airmont NP perf/x86/cstate: Add Airmont NP bpf: Recognize special arithmetic shift in the verifier firmware: arm_ffa: Unmap Rx/Tx buffers on init failure gpu/panel-edp: add AUO panel entry for B140HAN06.4 drm/amdgpu: fix NULL pointer issue buffer funcs ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET media: chips-media: wave5: Fix conditional in start_streaming media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder drm/amd/display: Fix dsc eDP issue drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() media: mt9m114: Avoid a reset low spike during probe() media: mt9m114: Return -EPROBE_DEFER if no endpoint is found ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk PCI: Add Intel Nova Lake audio Device ID drm/amd/display: Disable FEC when powering down encoders drm/amd/display: avoid dig reg access timeout on usb4 link training fail hwmon: (dell-smm) Add support for Dell OptiPlex 7080 HID: logitech-hidpp: Add support for Logitech K980 ASoC: SOF: Intel: hda: Fix NULL pointer dereference spi: geni-qcom: Fix abort sequence execution for serial engine errors ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx wifi: rtw89: 8922a: set random mac if efuse contains zeroes wifi: rtw89: ser: enable error IMR after recovering from L1 wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() wifi: rtw89: mac: correct page number for CSI response wifi: ath11k: Fix failure to connect to a 6 GHz AP ipv6: annotate data-races over sysctl.flowlabel_reflect ext4: use reserved metadata blocks when splitting extent on endio Bluetooth: btusb: Add support for MediaTek7920 0489:e158 net: sfp: add quirk for Lantech 8330-265D PCI/AER: Clear stale errors on reporting agents upon probe scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event riscv: vector: init vector context with proper vlenb HID: i2c-hid: Add FocalTech FT8112 9p/xen: protect xen_9pfs_front_free against concurrent calls soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list most: remove usage of the deprecated ida_simple_xx() API most: core: fix resource leak in most_register_interface error paths usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() serial: 8250: 8250_omap.c: Add support for handling UART error conditions mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 drm/amd/display: Fix writeback on DCN 3.2+ drm/amd/display: Fix system resume lag issue drm/amd/display: bypass post csc for additional color spaces in dal spi: spidev: fix lock inversion between spi_lock and buf_lock Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short kcm: fix zero-frag skb in frag_list on partial sendmsg error net/mlx5: E-switch, Clear legacy flag when moving to switchdev net/mlx5e: Separate address related variables to be in struct net/mlx5e: Support routed networks during IPsec MACs initialization net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query drm/tests: shmem: Swap names of export tests KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR media: amphion: Drop min_queued_buffers assignment media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() media: ccs: Fix setting initial sub-device state platform/x86: ISST: Add missing write block check bus: omap-ocp2scp: fix OF populate on driver rebind media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop drm/buddy: Prevent BUG_ON by validating rounded allocation xfs: remove xfs_attr_leaf_hasname mfd: qcom-pm8xxx: Fix OF populate on driver rebind mfd: omap-usb-host: Fix OF populate on driver rebind xfs: fix the xattr scrub to detect freemap/entries array collisions pinctrl: intel: Add code name documentation xfs: check for deleted cursors when revalidating two btrees vhost: move vdpa group bound check to vhost_vdpa clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 mm/slab: use unsigned long for orig_size to ensure proper metadata align drm/amd/display: Increase DCN35 SR enter/exit latency drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify mm: numa_memblks: Identify the accurate NUMA ID of CFMW drm/amdgpu: keep vga memory on MacBooks with switchable graphics most: core: fix leak on early registration failure Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req UBUNTU: Upstream stable to v6.6.128, v6.12.75 ** Affects: linux (Ubuntu) Importance: Undecided Status: Invalid ** Affects: linux (Ubuntu Noble) Importance: Medium Assignee: Noah Wager (nwager) Status: In Progress ** Tags: kernel-stable-tracking-bug ** Changed in: linux (Ubuntu) Status: New => Confirmed ** Also affects: linux (Ubuntu Noble) Importance: Undecided Status: New ** Changed in: linux (Ubuntu) Status: Confirmed => Invalid ** Changed in: linux (Ubuntu Noble) Importance: Undecided => Medium ** Changed in: linux (Ubuntu Noble) Status: New => In Progress ** Changed in: linux (Ubuntu Noble) Assignee: (unassigned) => Noah Wager (nwager) ** Description changed: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-05-01 + + Ported from the following upstream stable releases: + v6.6.128, v6.12.75 + from git://git.kernel.org/ + + RDMA/siw: Fix potential NULL pointer dereference in header processing + RDMA/umad: Reject negative data_len in ib_umad_write + auxdisplay: arm-charlcd: fix release_mem_region() size + hfsplus: return error when node already exists in hfs_bnode_create + rcu: s/boost_kthread_mutex/kthread_mutex + rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() + rcu: Refactor expedited handling check in rcu_read_unlock_special() + rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() + rcu: Fix rcu_read_unlock() deadloop due to softirq + audit: move the compat_xxx_class[] extern declarations to audit_arch.h + i3c: Move device name assignment after i3c_bus_init + fs: add <linux/init_task.h> for 'init_fs' + i3c: master: Update hot-join flag only on success + gfs2: Retries missing in gfs2_{rename,exchange} + gfs2: Fix use-after-free in iomap inline data write path + i3c: dw: Initialize spinlock to avoid upsetting lockdep + tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure + tpm: st33zp24: Fix missing cleanup on get_burstcount() error + btrfs: qgroup: return correct error when deleting qgroup relation item + btrfs: fix block_group_tree dirty_list corruption + smb: client: fix potential UAF and double free in smb2_open_file() + xen/virtio: Don't use grant-dma-ops when running as Dom0 + ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() + io_uring/sync: validate passed in offset + cpuidle: menu: Cleanup after loadavg removal + cpuidle: governors: menu: Always check timers with tick stopped + md/raid10: fix any_working flag handling in raid10_sync_request + iomap: fix submission side handling of completion side errors + ublk: Validate SQE128 flag before accessing the cmd + x86/xen: make some functions static + Partial revert "x86/xen: fix balloon target initialization for PVH dom0" + PM: wakeup: Handle empty list in wakeup_sources_walk_start() + perf: arm_spe: Properly set hw.state on failures + PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races + s390/cio: Fix device lifecycle handling in css_alloc_subchannel() + crypto: qat - fix warning on adf_pfvf_pf_proto.c + selftests/bpf: veristat: fix printing order in output_stats() + libbpf: Fix OOB read in btf_dump_get_bitfield_value + ARM: VDSO: Patch out __vdso_clock_getres() if unavailable + crypto: cavium - fix dma_free_coherent() size + crypto: octeontx - fix dma_free_coherent() size + crypto: hisilicon/zip - adjust the way to obtain the req in the callback function + crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable + hrtimer: Fix trace oddity + bpf, sockmap: Fix incorrect copied_seq calculation + bpf, sockmap: Fix FIONREAD for sockmap + crypto: hisilicon/trng - modifying the order of header files + crypto: hisilicon/trng - support tfms sharing the device + bpf: Fix bpf_xdp_store_bytes proto for read-only arg + scsi: efct: Use IRQF_ONESHOT and default primary handler + EDAC/altera: Remove IRQF_ONESHOT + mfd: wm8350-core: Use IRQF_ONESHOT + sched/rt: Skip currently executing CPU in rto_next_cpu() + pstore/ram: fix buffer overflow in persistent_ram_save_old() + soc: qcom: smem: handle ENOMEM error during probe + EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() + EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() + arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings + clk: qcom: Return correct error code in qcom_cc_probe_by_index() + arm64: dts: qcom: sdm630: fix gpu_speed_bin size + arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on + ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property + powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() + soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe + soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() + powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling + ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells + arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node + arm64: dts: amlogic: axg: assign the MMC signal clocks + arm64: dts: amlogic: gx: assign the MMC signal clocks + arm64: dts: amlogic: g12: assign the MMC B and C signal clocks + arm64: dts: amlogic: g12: assign the MMC A signal clock + arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 + arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 + arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions + workqueue: Factor out assign_rescuer_work() + workqueue: Only assign rescuer work when really needed + workqueue: Process rescuer work items one-by-one using a cursor + smack: /smack/doi must be > 0 + smack: /smack/doi: accept previously used values + ASoC: nau8821: Consistently clear interrupts before unmasking + ASoC: nau8821: Avoid unnecessary blocking in IRQ handler + ASoC: nau8821: Fixup nau8821_enable_jack_detect() + drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init + drm/msm/disp/dpu: add merge3d support for sc7280 + regulator: core: move supply check earlier in set_machine_constraints() + HID: playstation: Add missing check for input_ff_create_memless + drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x + media: ccs: Accommodate C-PHY into the calculation + drm/msm/a2xx: fix pixel shader start on A225 + platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev + media: uvcvideo: Fix allocation for small frame sizes + platform/chrome: cros_ec_lightbar: Fix response size initialization + spi: tools: Add include folder to .gitignore + Revert "hwmon: (ibmpex) fix use-after-free in high/low store" + PCI: mediatek: Fix IRQ domain leak when MSI allocation fails + Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors + PCI/PM: Avoid redundant delays on D3hot->D3cold + PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails + Documentation: tracing: Add ring-buffer mapping + docs: fix WARNING document not included in any toctree + Documentation: trace: Refactor toctree + Documentation: tracing: Add PCI tracepoint documentation + PCI: Do not attempt to set ExtTag for VFs + PCI/portdrv: Fix potential resource leak + quota: fix livelock between quotactl and freeze_super + net: mctp-i2c: fix duplicate reception of old data + mctp i2c: initialise event handler read bytes + wifi: cfg80211: stop NAN and P2P in cfg80211_leave + netfilter: nf_tables: reset table validation state on abort + netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH + netfilter: nf_conncount: increase the connection clean up limit to 64 + netfilter: nft_compat: add more restrictions on netlink attributes + netfilter: nf_conncount: fix tracking of connections from localhost + module: add helper function for reading module_buildid() + kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() + PCI: Mark 3ware-9650SA Root Port Extended Tags as broken + iommu/vt-d: Flush cache for PASID table before using it + dm: use bio_clone_blkg_association + nfsd: never defer requests during idmap lookup + fat: avoid parent link count underflow in rmdir + tcp: tcp_tx_timestamp() must look at the rtx queue + wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() + PCI: Initialize RCB from pci_configure_device() + PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros + PCI: Add defines for bridge window indexing + PCI/ACPI: Restrict program_hpx_type2() to AER bits + ipc: don't audit capability check in ipc_permissions() + ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() + of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() + mptcp: fix receive space timestamp initialization + octeontx2-af: Fix PF driver crash with kexec kernel booting + bonding: only set speed/duplex to unknown, if getting speed failed + inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP + nfc: hci: shdlc: Stop timers and work before freeing context + netfilter: nft_set_hash: fix get operation on big endian + netfilter: nft_counter: fix reset of counters on 32bit archs + netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets + PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] + net: hns3: fix double free issue for tx spare buffer + procfs: fix missing RCU protection when reading real_parent in do_task_stat() + smb: client: correct value for smbd_max_fragmented_recv_size + net: atm: fix crash due to unvalidated vcc pointer in sigd_send() + net: sunhme: Fix sbus regression + net: Add skb_dstref_steal and skb_dstref_restore + net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers + xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path + serial: caif: fix use-after-free in caif_serial ldisc_close() + octeon_ep: disable per ring interrupts + octeon_ep: ensure dbell BADDR updation + ionic: Rate limit unknown xcvr type messages + octeontx2-pf: Unregister devlink on probe failure + RDMA/rtrs: server: remove dead code + IB/cache: update gid cache on client reregister event + RDMA/hns: Fix WQ_MEM_RECLAIM warning + RDMA/hns: Notify ULP of remaining soft-WCs during reset + power: supply: ab8500: Fix use-after-free in power_supply_changed() + power: supply: act8945a: Fix use-after-free in power_supply_changed() + power: supply: bq256xx: Fix use-after-free in power_supply_changed() + power: supply: bq25980: Fix use-after-free in power_supply_changed() + power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() + power: supply: goldfish: Fix use-after-free in power_supply_changed() + power: supply: rt9455: Fix use-after-free in power_supply_changed() + power: supply: sbs-battery: Fix use-after-free in power_supply_changed() + power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write + power: supply: bq27xxx: fix wrong errno when bus ops are unsupported + power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() + RDMA/rtrs-srv: fix SG mapping + RDMA/rxe: Fix double free in rxe_srq_from_init + tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() + mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper + crypto: ccp - Add an S4 restore flow + crypto: ccp - Factor out ring destroy handling to a helper + crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails + mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() + RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send + RDMA/rxe: Fix race condition in QP timer handlers + svcrdma: Increase the per-transport rw_ctx count + svcrdma: Reduce the number of rdma_rw contexts per-QP + RDMA/core: add rdma_rw_max_sge() helper for SQ sizing + cxl: Fix premature commit_end increment on decoder commit failure + mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() + mtd: spinand: Fix kernel doc + power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer + RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc + pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN + scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() + scsi: ufs: host: mediatek: Require CONFIG_PM + scsi: csiostor: Fix dereference of null pointer rn + nvdimm: virtio_pmem: serialize flush requests + fs/nfs: Fix readdir slow-start regression + tracing: Properly process error handling in event_hist_trigger_parse() + tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros + fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() + fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() + clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs + clk: qcom: rcg2: compute 2d using duty fraction directly + clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs + clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops + clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops + clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops + clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc + clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc + clk: qcom: gcc-ipq5018: flag sleep clock as critical + clk: Move clk_{save,restore}_context() to COMMON_CLK section + clk: qcom: dispcc-sdm845: Enable parents for pixel clocks + clk: qcom: gfx3d: add parent to parent request map + clk: mediatek: Fix error handling in runtime PM setup + dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX + dma: dma-axi-dmac: fix SW cyclic transfers + staging: greybus: lights: avoid NULL deref + serial: imx: change SERIAL_IMX_CONSOLE to bool + serial: SH_SCI: improve "DMA support" prompt + mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms + iio: pressure: mprls0025pa: fix scan_type struct + watchdog: starfive-wdt: Fix PM reference leak in probe error path + coresight: etm3x: Fix cpulocked warning on cpuhp + Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" + mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure + mfd: simple-mfd-i2c: Add MAX77705 support + mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA + mfd: simple-mfd-i2c: Add SpacemiT P1 support + mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order + mfd: simple-mfd-i2c: Add Delta TN48M CPLD support + UBUNTU: [Config] Disable new Delta TN48M CPLD support by default + drivers: iio: mpu3050: use dev_err_probe for regulator request + usb: bdc: fix sleep during atomic + pinctrl: equilibrium: Fix device node reference leak in pinbank_init() + ovl: Fix uninit-value in ovl_fill_real + iio: sca3000: Fix a resource leak in sca3000_probe() + pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition + pinctrl: single: fix refcount leak in pcs_add_gpio_func() + leds: qcom-lpg: Check the return value of regmap_bulk_write() + backlight: qcom-wled: Support ovp values for PMI8994 + backlight: qcom-wled: Change PM8950 WLED configurations + dmaengine: fsl-edma: don't explicitly disable clocks in .remove() + io_uring/cancel: de-unionize file and user_data in struct io_cancel_data + fs/ntfs3: prevent infinite loops caused by the next valid being the same + fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot + ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs + powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check + kbuild: Add objtool to top-level clean target + selftests/memfd: delete unused declarations + selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT + ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO + cpuidle: Skip governor when only one idle state is available + selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 + net: sparx5/lan969x: fix DWRR cost max to match hardware register width + net: mscc: ocelot: extract ocelot_xmit_timestamp() helper + net: mscc: ocelot: split xmit into FDMA and register injection paths + net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() + ipv6: Fix out-of-bound access in fib6_add_rt2node(). + net: sparx5/lan969x: fix PTP clock max_adj value + net: usb: catc: enable basic endpoint checking + xen-netback: reject zero-queue configuration from guest + net/rds: rds_sendmsg should not discard payload_len + net: bridge: mcast: always update mdb_n_entries for vlan contexts + selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled + selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled + netfilter: nf_conntrack_h323: don't pass uninitialised l3num value + net: remove WARN_ON_ONCE when accessing forward path array + netfilter: nf_tables: fix use-after-free in nf_tables_addchain() + ipv6: fix a race in ip6_sock_set_v6only() + bpftool: Fix truncated netlink dumps + ping: annotate data-races in ping_lookup() + macvlan: observe an RCU grace period in macvlan_common_newlink() error path + icmp: move icmp_global.credit and icmp_global.stamp to per netns storage + icmp: icmp_msgs_per_sec and icmp_msgs_burst sysctls become per netns + icmp: prevent possible overflow in icmp_global_allow() + cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) + inet: move icmp_global_{credit,stamp} to a separate cache line + octeontx2-af: Fix default entries mcam entry action + bonding: alb: fix UAF in rlb_arp_recv during bond up/down + net/mlx5: Fix multiport device check over light SFs + apparmor: fix NULL sock in aa_sock_file_perm + apparmor: return -ENOMEM in unpack_perms_table upon alloc failure + apparmor: fix rlimit for posix cpu timers + apparmor: remove apply_modes_to_perms from label_match + apparmor: make label_match return a consistent value + apparmor: fix invalid deref of rawdata when export_binary is unset + apparmor: fix aa_label to return state from compount and component match + drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() + drm/amdgpu: Fix memory leak in amdgpu_ras_init() + drm/i915/acpi: free _DSM package when no connectors + ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init + drm/amdkfd: fix debug watchpoints for logical devices + drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 + spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() + spi: wpcm-fiu: Fix uninitialized res + spi: wpcm-fiu: Simplify with dev_err_probe() + spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() + s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n + efi: Fix reservation of unaccepted memory table + btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found + x86/hyperv: Fix error pointer dereference + ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk + drm/amd/display: Use same max plane scaling limits for all 64 bpp formats + MIPS: Work around LLVM bug when gp is used as global register variable + ext4: don't cache extent during splitting extent + ext4: fix memory leak in ext4_ext_shift_extents() + ext4: use optimized mballoc scanning regardless of inode format + ata: pata_ftide010: Fix some DMA timings + ata: libata-scsi: refactor ata_scsi_translate() + SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths + SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path + ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names + ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names + perf test stat: Update test expectations and events + perf test stat tests: Fix for virtualized machines + perf unwind-libdw: Fix invalid reference counts + perf callchain: Fix srcline printing with inlines + libsubcmd: Fix null intersection case in exclude_cmds() + libperf: Don't remove -g when EXTRA_CFLAGS are used + libperf build: Always place libperf includes first + rtc: interface: Alarm race handling should not discard preceding error + audit: add fchmodat2() to change attributes class + hfsplus: fix volume corruption issue for generic/498 + fs/buffer: add alert in try_to_free_buffers() for folios without buffers + audit: add missing syscalls to read class + hfsplus: pretend special inodes as regular files + i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() + minix: Add required sanity checking to minix_check_superblock() + btrfs: handle user interrupt properly in btrfs_trim_fs() + smb: client: add proper locking around ses->iface_last_update + gfs2: fiemap page fault fix + smb: client: prevent races in ->query_interfaces() + tools/power cpupower: Reset errno before strtoull() + s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS + perf/arm-cmn: Support CMN-600AE + arm64: Add support for TSV110 Spectre-BHB mitigation + rnbd-srv: Zero the rsp buffer before using it + x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set + EFI/CPER: don't dump the entire memory region + APEI/GHES: ensure that won't go past CPER allocated record + EFI/CPER: don't go past the ARM processor CPER record buffer + ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() + ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP + md-cluster: fix NULL pointer dereference in process_metadata_update + cpufreq: dt-platdev: Block the driver from probing on more QC platforms + s390/perf: Disable register readout on sampling events + perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD + xenbus: Use .freeze/.thaw to handle xenbus devices + blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() + sparc: Synchronize user stack on fork and clone + sparc: don't reference obsolete termio struct for TC* constants + bpf: verifier improvement in 32bit shift sign extension pattern + clocksource/drivers/sh_tmu: Always leave device running after probe + clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF + PCI/MSI: Unmap MSI-X region on error + crypto: hisilicon/qm - move the barrier before writing to the mailbox register + mailbox: bcm-ferxrm-mailbox: Use default primary handler + char: tpm: cr50: Remove IRQF_ONESHOT + pstore: ram_core: fix incorrect success return when vmap() fails + arm64: tegra: smaug: Add usb-role-switch support + parisc: Prevent interrupts during reboot + drm/display/dp_mst: Add protection against 0 vcpi + spi-geni-qcom: initialize mode related registers to 0 + spi-geni-qcom: use xfer->bits_per_word for can_dma() + media: dvb-core: dmxdevfilter must always flush bufs + spi: stm32: fix Overrun issue at < 8bpw + drm/v3d: Set DMA segment size to avoid debug warnings + media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes + media: omap3isp: isppreview: always clamp in preview_try_format() + media: omap3isp: set initial format + media: mediatek: vcodec: Don't try to decode 422/444 VP9 + drm/amdgpu: add support for HDP IP version 6.1.1 + drm/amdgpu: avoid a warning in timedout job handler + HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards + ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask + ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug + spi: spi-mem: Limit octal DTR constraints to octal DTR situations + media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START + media: adv7180: fix frame interval in progressive mode + media: pvrusb2: fix URB leak in pvr2_send_request_ex + media: solo6x10: Check for out of bounds chip_id + media: cx25821: Fix a resource leak in cx25821_dev_setup() + media: v4l2-async: Fix error handling on steps after finding a match + drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() + drm: Account property blob allocations to memcg + hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed + virt: vbox: uapi: Mark inner unions in packed structs as packed + drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback + drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts + drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release + media: rkisp1: Fix filter mode register configuration + HID: multitouch: add eGalaxTouch EXC3188 support + HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK + ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro + gpio: aspeed-sgpio: Change the macro to support deferred probe + ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio + spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end + ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() + hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE + hwmon: (f71882fg) Add F81968 support + ASoC: es8328: Add error unwind in resume + modpost: Amend ppc64 save/restfpr symnames for -Os build + ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio + jfs: Add missing set_freezable() for freezable kthread + jfs: nlink overflow in jfs_rename + wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero + wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() + wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H + dm: replace -EEXIST with -EBUSY + dm: remove fake timeout to avoid leak request + iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency + wifi: libertas: fix WARNING in usb_tx_block + iommu/amd: move wait_on_sem() out of spinlock + wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode + PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port + wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 + wifi: ath12k: fix preferred hardware mode calculation + ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() + ipv6: exthdrs: annotate data-race over multiple sysctl + ext4: mark group add fast-commit ineligible + ext4: move ext4_percpu_param_init() before ext4_mb_init() + ext4: mark group extend fast-commit ineligible + netfilter: nf_conntrack: Add allow_clash to generic protocol handler + netfilter: xt_tcpmss: check remaining length before reading optlen + openrisc: define arch-specific version of nop() + net: usb: r8152: fix transmit queue timeout + wifi: iwlwifi: mvm: check the validity of noa_len + net/rds: No shortcut out of RDS_CONN_ERROR + gro: change the BUG_ON() in gro_pull_from_frag0() + ipv4: igmp: annotate data-races around idev->mr_maxdelay + net: hns3: extend HCLGE_FD_AD_QID to 11 bits + wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() + wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() + ipv4: fib: Annotate access to struct fib_alias.fa_state. + Bluetooth: hci_conn: Set link_policy on incoming ACL connections + Bluetooth: hci_conn: use mod_delayed_work for active mode timeout + Bluetooth: btusb: Add new VID/PID for RTL8852CE + Bluetooth: btusb: Add device ID for Realtek RTL8761BU + octeontx2-af: Workaround SQM/PSE stalls by disabling sticky + wifi: rtw89: pci: restore LDO setting after device resume + wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() + net: usb: sr9700: remove code to drive nonexistent multicast filter + vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 + net/rds: Clear reconnect pending bit + PCI: Mark ASM1164 SATA controller to avoid bus reset + PCI: Fix pci_slot_lock () device locking + PCI: Enable ACS after configuring IOMMU for OF platforms + PCI: Add ACS quirk for Qualcomm Hamoa & Glymur + PCI: Mark Nvidia GB10 to avoid bus reset + myri10ge: avoid uninitialized variable use + nfc: nxp-nci: remove interrupt trigger type + RDMA/rtrs-clt: For conn rejection use actual err number + ata: libata: avoid long timeouts on hot-unplugged SATA DAS + hisi_acc_vfio_pci: update status after RAS error + scsi: buslogic: Reduce stack usage + vhost: fix caching attributes of MMIO regions by setting them explicitly + tracing: Fix false sharing in hwlat get_sample() + remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized + mailbox: pcc: Remove spurious IRQF_ONESHOT usage + mailbox: imx: Skip the suspend flag for i.MX7ULP + mailbox: sprd: mask interrupts that are not handled + remoteproc: mediatek: Break lock dependency to `prepare_lock` + mailbox: sprd: clear delivery flag before handling TX done + clk: microchip: core: correct return value on *_get_parent() + m68k: nommu: fix memmove() with differently aligned src and dest for 68000 + soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) + staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure + serial: 8250_dw: handle clock enable errors in runtime_resume + usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs + fpga: of-fpga-region: Fail if any bridge is missing + dmaengine: sun6i: Choose appropriate burst length under maxburst + dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings + misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() + misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 + staging: rtl8723bs: fix memory leak on failure path + serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done + fix it87_wdt early reboot by reporting running timer + binder: don't use %pK through printk + watchdog: imx7ulp_wdt: handle the nowayout option + phy: mvebu-cp110-utmi: fix dr_mode property read from dts + phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature + Revert "mfd: da9052-spi: Change read-mask to write-mask" + iio: Use IRQF_NO_THREAD + iio: magnetometer: Remove IRQF_ONESHOT + MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE + fs: ntfs3: check return value of indx_find to avoid infinite loop + fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata + fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST + fs/ntfs3: drop preallocated clusters for sparse and compressed files + fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() + ceph: supply snapshot context in ceph_uninline_data() + libceph: define and enforce CEPH_MAX_KEY_LEN + thermal: int340x: Fix sysfs group leak on DLVR registration failure + include: uapi: netfilter_bridge.h: Cover for musl libc + ARM: 9467/1: mm: Don't use %pK through printk + drm/amd/display: Avoid updating surface with the same surface under MPO + drm/amdgpu: Adjust usleep_range in fence wait + ALSA: usb-audio: Update the number of packets properly at receiving + drm/amdgpu: Add HAINAN clock adjustment + drm/radeon: Add HAINAN clock adjustment + ALSA: usb-audio: Add sanity check for OOB writes at silencing + btrfs: replace BUG() with error handling in __btrfs_balance() + drm/amd/display: Remove conditional for shaper 3DLUT power-on + rtc: zynqmp: correct frequency value + ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access + ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut + xfrm6: fix uninitialized saddr in xfrm6_get_saddr() + xfrm: skip templates check for packet offload tunnel mode + ipmi: ipmb: initialise event handler read bytes + xfrm: always flush state and policy upon NETDEV_UNREGISTER event + net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode + net: usb: lan78xx: scan all MDIO addresses on LAN7801 + net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() + net: ethernet: xscale: Check for PTP support properly + wifi: cfg80211: wext: fix IGTK key ID off-by-one + Remove WARN_ALL_UNSEEDED_RANDOM kernel config option + UBUNTU: [Config] Remove WARN_ALL_UNSEEDED_RANDOM + Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ + Bluetooth: hci_qca: Cleanup on all setup failures + Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ + Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ + Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ + tipc: fix duplicate publication key in tipc_service_insert_publ() + RDMA/core: Fix stale RoCE GIDs during netdev events at registration + net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets + RDMA/efa: Fix typo in efa_alloc_mr() + net: usb: pegasus: enable basic endpoint checking + RDMA/umem: Fix double dma_buf_unpin in failure path + net/mlx5: DR, Fix circular locking dependency in dump + net/mlx5: Fix missing devlink lock in SRIOV enable error path + net: consume xmit errors of GSO frames + dpaa2-switch: validate num_ifs to prevent out-of-bounds write + netfilter: nf_conntrack_h323: fix OOB read in decode_choice() + rpmsg: core: fix race in driver_override_show() and use core helper + clk: renesas: rzg2l: Fix intin variable size + clk: renesas: rzg2l: Select correct div round macro + ASoC: SOF: ipc4-control: If there is no data do not send bytes update + ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls + ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data + ASoC: SOF: ipc4-control: Keep the payload size up to date + fpga: dfl: use subsys_initcall to allow built-in drivers to be added + dm-verity: correctly handle dm_bufio_client_create() failure + media: mediatek: encoder: Fix uninitialized scalar variable issue + media: mtk-mdp: Fix error handling in probe function + media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() + media: verisilicon: AV1: Fix enable cdef computation + media: verisilicon: AV1: Fix tx mode bit setting + ARM: omap2: Fix reference count leaks in omap_control_init() + KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding + arm64: Disable branch profiling for all arm64 code + HID: hid-pl: handle probe errors + HID: magicmouse: Do not crash on missing msc->input + HID: prodikeys: Check presence of pm->input_ep82 + HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() + arm64: dts: apple: t8112-j473: Keep the HDMI port powered on + media: verisilicon: AV1: Set IDR flag for intra_only frame type + media: radio-keene: fix memory leak in error path + media: cx88: Add missing unmap in snd_cx88_hw_params() + media: cx23885: Add missing unmap in snd_cx23885_hw_params() + media: cx25821: Add missing unmap in snd_cx25821_hw_params() + media: i2c/tw9903: Fix potential memory leak in tw9903_probe() + media: i2c/tw9906: Fix potential memory leak in tw9906_probe() + media: i2c: ov01a10: Fix the horizontal flip control + media: i2c: ov01a10: Fix reported pixel-rate value + media: i2c: ov01a10: Fix analogue gain range + media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls + media: i2c: ov01a10: Fix test-pattern disabling + media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() + media: ccs: Avoid possible division by zero + media: i2c: ov5647: Initialize subdev before controls + media: i2c: ov5647: Correct pixel array offset + media: i2c: ov5647: Correct minimum VBLANK value + media: i2c: ov5647: Sensor should report RAW color space + media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode + media: i2c: ov5647: use our own mutex for the ctrl lock + dm-integrity: fix a typo in the code for write/discard race + dm: clear cloned request bio pointer when last clone bio completes + soc: ti: k3-socinfo: Fix regmap leak on probe failure + soc: ti: pruss: Fix double free in pruss_clk_mux_setup() + KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation + clk: clk-apple-nco: Add "apple,t8103-nco" compatible + media: i2c: ov01a10: Fix digital gain range + clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() + s390/pci: Handle futile config accesses of disabled devices directly + dm-integrity: fix recalculation in bitmap mode + dm-unstripe: fix mapping bug when there are multiple targets in a table + arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro + media: venus: vdec: fix error state assignment for zero bytesused + media: venus: vdec: restrict EOS addr quirk to IRIS2 only + drm: of: drm_of_panel_bridge_remove(): fix device_node leak + mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations + selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs + xfs: mark data structures corrupt on EIO and ENODATA + media: verisilicon: AV1: Fix tile info buffer size + iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode + mfd: core: Add locking around 'mfd_of_node_list' + xfs: delete attr leaf freemap entries when empty + xfs: fix freemap adjustments when adding xattrs to leaf blocks + xfs: fix remote xattr valuelblk check + KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() + PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions + md/bitmap: fix GPF in write_page caused by resize race + nfsd: fix return error code for nfsd_map_name_to_[ug]id + nvmem: Drop OF node reference on nvmem_add_one_cell() failure + usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN + bus: fsl-mc: fix an error handling in fsl_mc_device_add() + dm mpath: make pg_init_delay_msecs settable + tools: Fix bitfield dependency failure + powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() + iio: gyro: itg3200: Fix unchecked return value in read_raw + mm/highmem: fix __kmap_to_page() build error + rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() + ocfs2: fix reflink preserve cleanup issue + kexec: derive purgatory entry from symbol + Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" + PCI/IOV: Fix race between SR-IOV enable/disable and hotplug + arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y + btrfs: continue trimming remaining devices on failure + remoteproc: imx_rproc: Fix invalid loaded resource table detection + perf/arm-cmn: Reject unsupported hardware configurations + scsi: ufs: core: Flush exception handling work when RPM level is zero + usb: dwc3: gadget: Move vbus draw to workqueue context + usb: dwc2: fix resume failure if dr_mode is host + mtd: rawnand: pl353: Fix software ECC support + tipc: fix RCU dereference race in tipc_aead_users_dec() + drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() + net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path + PCI: Fix pci_slot_trylock() error handling + parisc: kernel: replace kfree() with put_device() in create_tree_node() + staging: rtl8723bs: fix null dereference in find_network + cifs: Fix locking usage for tcon fields + MIPS: rb532: Fix MMIO UART resource registration + ceph: supply snapshot context in ceph_zero_partial_object() + LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE + LoongArch: Prefer top-down allocation after arch_mem_init() + LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT + LoongArch: Disable instrumentation for setup_ptwalker() + net: ethernet: marvell: skge: remove incorrect conflicting PCI ID + net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() + octeontx2-af: CGX: fix bitmap leaks + net: macb: Fix tx/rx malfunction after phy link down and up + tracing: Fix to set write permission to per-cpu buffer_size_kb + io_uring/filetable: clamp alloc_hint to the configured alloc range + net: intel: fix PCI device ID conflict between i40e and ipw2200 + atm: fore200e: fix use-after-free in tasklets during device removal + ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() + fbcon: check return value of con2fb_acquire_newinfo() + fbdev: vt8500lcdfb: fix missing dma_free_coherent() + fbdev: of: display_timing: fix refcount leak in of_get_display_timings() + fbdev: ffb: fix corrupted video output on Sun FFB1 + fbcon: Remove struct fbcon_display.inverse + cifs: some missing initializations on replay + ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR + net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle + net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() + x86/kexec: Copy ACPI root pointer address from config table + arm64: Force the use of CNTVCT_EL0 in __delay() + net: nfc: nci: Fix parameter validation for packet data + tracing: Fix checking of freed trace_event_file for hist files + tracing: Wake up poll waiters for hist files when removing an event + NTB: ntb_transport: Fix too small buffer for debugfs_name + drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros + arm64: Fix sampling the "stable" virtual counter in preemptible section + gfs2: Fix slab-use-after-free in qd_put + io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED + thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature + OPP: Return correct value in dev_pm_opp_get_level + cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() + perf/x86/core: Do not set bit width for unavailable counters + genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). + platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() + media: pci: mg4b: Use IRQF_NO_THREAD + firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET + arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 + arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node + arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm + arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) + media: chips-media: wave5: Fix memory leak on codec_info allocation failure + drm/amd: Drop "amdgpu kernel modesetting enabled" message + drm/amdkfd: Fix signal_eviction_fence() bool return value + drm/xe: Unregister drm device on probe error + HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients + wifi: cfg80211: Fix use_for flag update on BSS refresh + PCI: Check parent for NULL in of_pci_bus_release_domain_nr() + netfilter: nfnetlink_queue: optimize verdict lookup with hash table + netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation + netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval + power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() + power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() + RDMA/mlx5: Fix UMR hang in LAG error state unload + IB/mlx5: Fix port speed query for representors + platform/x86/amd/pmf: Prevent TEE errors after hibernate + crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails + power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler + clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs + clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops + clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops + dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue + iio: pressure: mprls0025pa: fix interrupt flag + objpool: fix the overestimation of object pooling metadata size + ipvs: do not keep dest_dst if dev is going down + net/mlx5e: Use unsigned for mlx5e_get_max_num_channels + AppArmor: Allow apparmor to handle unaligned dfa tables + apparmor: Fix & Optimize table creation from possibly unaligned memory + apparmor: avoid per-cpu hold underflow in aa_get_buffer + drm/amd/display: Fix out-of-bounds stream encoder index v3 + btrfs: use the correct type to initialize block reserve for delayed refs + Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT + i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init + APEI/GHES: ARM processor Error: don't go past allocated memory + ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] + powercap: intel_rapl: Add PL4 support for Ice Lake + alpha: fix user-space corruption during memory compaction + ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) + ACPI: battery: fix incorrect charging status when current is zero + perf/x86/msr: Add Airmont NP + perf/x86/cstate: Add Airmont NP + bpf: Recognize special arithmetic shift in the verifier + firmware: arm_ffa: Unmap Rx/Tx buffers on init failure + gpu/panel-edp: add AUO panel entry for B140HAN06.4 + drm/amdgpu: fix NULL pointer issue buffer funcs + ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET + media: chips-media: wave5: Fix conditional in start_streaming + media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder + drm/amd/display: Fix dsc eDP issue + drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() + media: mt9m114: Avoid a reset low spike during probe() + media: mt9m114: Return -EPROBE_DEFER if no endpoint is found + ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk + PCI: Add Intel Nova Lake audio Device ID + drm/amd/display: Disable FEC when powering down encoders + drm/amd/display: avoid dig reg access timeout on usb4 link training fail + hwmon: (dell-smm) Add support for Dell OptiPlex 7080 + HID: logitech-hidpp: Add support for Logitech K980 + ASoC: SOF: Intel: hda: Fix NULL pointer dereference + spi: geni-qcom: Fix abort sequence execution for serial engine errors + ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx + wifi: rtw89: 8922a: set random mac if efuse contains zeroes + wifi: rtw89: ser: enable error IMR after recovering from L1 + wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() + wifi: rtw89: mac: correct page number for CSI response + wifi: ath11k: Fix failure to connect to a 6 GHz AP + ipv6: annotate data-races over sysctl.flowlabel_reflect + ext4: use reserved metadata blocks when splitting extent on endio + Bluetooth: btusb: Add support for MediaTek7920 0489:e158 + net: sfp: add quirk for Lantech 8330-265D + PCI/AER: Clear stale errors on reporting agents upon probe + scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event + riscv: vector: init vector context with proper vlenb + HID: i2c-hid: Add FocalTech FT8112 + 9p/xen: protect xen_9pfs_front_free against concurrent calls + soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list + most: remove usage of the deprecated ida_simple_xx() API + most: core: fix resource leak in most_register_interface error paths + usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() + serial: 8250: 8250_omap.c: Add support for handling UART error conditions + mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs + ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 + drm/amd/display: Fix writeback on DCN 3.2+ + drm/amd/display: Fix system resume lag issue + drm/amd/display: bypass post csc for additional color spaces in dal + spi: spidev: fix lock inversion between spi_lock and buf_lock + Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings + Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short + kcm: fix zero-frag skb in frag_list on partial sendmsg error + net/mlx5: E-switch, Clear legacy flag when moving to switchdev + net/mlx5e: Separate address related variables to be in struct + net/mlx5e: Support routed networks during IPsec MACs initialization + net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query + drm/tests: shmem: Swap names of export tests + KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR + media: amphion: Drop min_queued_buffers assignment + media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() + media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() + media: ccs: Fix setting initial sub-device state + platform/x86: ISST: Add missing write block check + bus: omap-ocp2scp: fix OF populate on driver rebind + media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop + drm/buddy: Prevent BUG_ON by validating rounded allocation + xfs: remove xfs_attr_leaf_hasname + mfd: qcom-pm8xxx: Fix OF populate on driver rebind + mfd: omap-usb-host: Fix OF populate on driver rebind + xfs: fix the xattr scrub to detect freemap/entries array collisions + pinctrl: intel: Add code name documentation + xfs: check for deleted cursors when revalidating two btrees + vhost: move vdpa group bound check to vhost_vdpa + clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 + mm/slab: use unsigned long for orig_size to ensure proper metadata align + drm/amd/display: Increase DCN35 SR enter/exit latency + drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify + mm: numa_memblks: Identify the accurate NUMA ID of CFMW + drm/amdgpu: keep vga memory on MacBooks with switchable graphics + most: core: fix leak on early registration failure + Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req + UBUNTU: Upstream stable to v6.6.128, v6.12.75 -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2150809 Title: Noble update: upstream stable patchset 2026-05-01 Status in linux package in Ubuntu: Invalid Status in linux source package in Noble: In Progress Bug description: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-05-01 Ported from the following upstream stable releases: v6.6.128, v6.12.75 from git://git.kernel.org/ RDMA/siw: Fix potential NULL pointer dereference in header processing RDMA/umad: Reject negative data_len in ib_umad_write auxdisplay: arm-charlcd: fix release_mem_region() size hfsplus: return error when node already exists in hfs_bnode_create rcu: s/boost_kthread_mutex/kthread_mutex rcu/exp: Move expedited kthread worker creation functions above rcutree_prepare_cpu() rcu: Refactor expedited handling check in rcu_read_unlock_special() rcu: Remove local_irq_save/restore() in rcu_preempt_deferred_qs_handler() rcu: Fix rcu_read_unlock() deadloop due to softirq audit: move the compat_xxx_class[] extern declarations to audit_arch.h i3c: Move device name assignment after i3c_bus_init fs: add <linux/init_task.h> for 'init_fs' i3c: master: Update hot-join flag only on success gfs2: Retries missing in gfs2_{rename,exchange} gfs2: Fix use-after-free in iomap inline data write path i3c: dw: Initialize spinlock to avoid upsetting lockdep tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure tpm: st33zp24: Fix missing cleanup on get_burstcount() error btrfs: qgroup: return correct error when deleting qgroup relation item btrfs: fix block_group_tree dirty_list corruption smb: client: fix potential UAF and double free in smb2_open_file() xen/virtio: Don't use grant-dma-ops when running as Dom0 ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() io_uring/sync: validate passed in offset cpuidle: menu: Cleanup after loadavg removal cpuidle: governors: menu: Always check timers with tick stopped md/raid10: fix any_working flag handling in raid10_sync_request iomap: fix submission side handling of completion side errors ublk: Validate SQE128 flag before accessing the cmd x86/xen: make some functions static Partial revert "x86/xen: fix balloon target initialization for PVH dom0" PM: wakeup: Handle empty list in wakeup_sources_walk_start() perf: arm_spe: Properly set hw.state on failures PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races s390/cio: Fix device lifecycle handling in css_alloc_subchannel() crypto: qat - fix warning on adf_pfvf_pf_proto.c selftests/bpf: veristat: fix printing order in output_stats() libbpf: Fix OOB read in btf_dump_get_bitfield_value ARM: VDSO: Patch out __vdso_clock_getres() if unavailable crypto: cavium - fix dma_free_coherent() size crypto: octeontx - fix dma_free_coherent() size crypto: hisilicon/zip - adjust the way to obtain the req in the callback function crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable hrtimer: Fix trace oddity bpf, sockmap: Fix incorrect copied_seq calculation bpf, sockmap: Fix FIONREAD for sockmap crypto: hisilicon/trng - modifying the order of header files crypto: hisilicon/trng - support tfms sharing the device bpf: Fix bpf_xdp_store_bytes proto for read-only arg scsi: efct: Use IRQF_ONESHOT and default primary handler EDAC/altera: Remove IRQF_ONESHOT mfd: wm8350-core: Use IRQF_ONESHOT sched/rt: Skip currently executing CPU in rto_next_cpu() pstore/ram: fix buffer overflow in persistent_ram_save_old() soc: qcom: smem: handle ENOMEM error during probe EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings clk: qcom: Return correct error code in qcom_cc_probe_by_index() arm64: dts: qcom: sdm630: fix gpu_speed_bin size arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user() soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe soc: mediatek: svs: Fix memory leak in svs_enable_debug_write() powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling ARM: dts: lpc32xx: Set motor PWM #pwm-cells property value to 3 cells arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node arm64: dts: amlogic: axg: assign the MMC signal clocks arm64: dts: amlogic: gx: assign the MMC signal clocks arm64: dts: amlogic: g12: assign the MMC B and C signal clocks arm64: dts: amlogic: g12: assign the MMC A signal clock arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0 arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1 arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions workqueue: Factor out assign_rescuer_work() workqueue: Only assign rescuer work when really needed workqueue: Process rescuer work items one-by-one using a cursor smack: /smack/doi must be > 0 smack: /smack/doi: accept previously used values ASoC: nau8821: Consistently clear interrupts before unmasking ASoC: nau8821: Avoid unnecessary blocking in IRQ handler ASoC: nau8821: Fixup nau8821_enable_jack_detect() drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init drm/msm/disp/dpu: add merge3d support for sc7280 regulator: core: move supply check earlier in set_machine_constraints() HID: playstation: Add missing check for input_ff_create_memless drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x media: ccs: Accommodate C-PHY into the calculation drm/msm/a2xx: fix pixel shader start on A225 platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev media: uvcvideo: Fix allocation for small frame sizes platform/chrome: cros_ec_lightbar: Fix response size initialization spi: tools: Add include folder to .gitignore Revert "hwmon: (ibmpex) fix use-after-free in high/low store" PCI: mediatek: Fix IRQ domain leak when MSI allocation fails Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors PCI/PM: Avoid redundant delays on D3hot->D3cold PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails Documentation: tracing: Add ring-buffer mapping docs: fix WARNING document not included in any toctree Documentation: trace: Refactor toctree Documentation: tracing: Add PCI tracepoint documentation PCI: Do not attempt to set ExtTag for VFs PCI/portdrv: Fix potential resource leak quota: fix livelock between quotactl and freeze_super net: mctp-i2c: fix duplicate reception of old data mctp i2c: initialise event handler read bytes wifi: cfg80211: stop NAN and P2P in cfg80211_leave netfilter: nf_tables: reset table validation state on abort netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH netfilter: nf_conncount: increase the connection clean up limit to 64 netfilter: nft_compat: add more restrictions on netlink attributes netfilter: nf_conncount: fix tracking of connections from localhost module: add helper function for reading module_buildid() kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup() PCI: Mark 3ware-9650SA Root Port Extended Tags as broken iommu/vt-d: Flush cache for PASID table before using it dm: use bio_clone_blkg_association nfsd: never defer requests during idmap lookup fat: avoid parent link count underflow in rmdir tcp: tcp_tx_timestamp() must look at the rtx queue wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump() PCI: Initialize RCB from pci_configure_device() PCI: Add PCIE_MSG_CODE_ASSERT_INTx message macros PCI: Add defines for bridge window indexing PCI/ACPI: Restrict program_hpx_type2() to AER bits ipc: don't audit capability check in ipc_permissions() ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy() mptcp: fix receive space timestamp initialization octeontx2-af: Fix PF driver crash with kexec kernel booting bonding: only set speed/duplex to unknown, if getting speed failed inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP nfc: hci: shdlc: Stop timers and work before freeing context netfilter: nft_set_hash: fix get operation on big endian netfilter: nft_counter: fix reset of counters on 32bit archs netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404] net: hns3: fix double free issue for tx spare buffer procfs: fix missing RCU protection when reading real_parent in do_task_stat() smb: client: correct value for smbd_max_fragmented_recv_size net: atm: fix crash due to unvalidated vcc pointer in sigd_send() net: sunhme: Fix sbus regression net: Add skb_dstref_steal and skb_dstref_restore net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path serial: caif: fix use-after-free in caif_serial ldisc_close() octeon_ep: disable per ring interrupts octeon_ep: ensure dbell BADDR updation ionic: Rate limit unknown xcvr type messages octeontx2-pf: Unregister devlink on probe failure RDMA/rtrs: server: remove dead code IB/cache: update gid cache on client reregister event RDMA/hns: Fix WQ_MEM_RECLAIM warning RDMA/hns: Notify ULP of remaining soft-WCs during reset power: supply: ab8500: Fix use-after-free in power_supply_changed() power: supply: act8945a: Fix use-after-free in power_supply_changed() power: supply: bq256xx: Fix use-after-free in power_supply_changed() power: supply: bq25980: Fix use-after-free in power_supply_changed() power: supply: cpcap-battery: Fix use-after-free in power_supply_changed() power: supply: goldfish: Fix use-after-free in power_supply_changed() power: supply: rt9455: Fix use-after-free in power_supply_changed() power: supply: sbs-battery: Fix use-after-free in power_supply_changed() power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write power: supply: bq27xxx: fix wrong errno when bus ops are unsupported power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed() RDMA/rtrs-srv: fix SG mapping RDMA/rxe: Fix double free in rxe_srq_from_init tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus() mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper crypto: ccp - Add an S4 restore flow crypto: ccp - Factor out ring destroy handling to a helper crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse() RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send RDMA/rxe: Fix race condition in QP timer handlers svcrdma: Increase the per-transport rw_ctx count svcrdma: Reduce the number of rdma_rw contexts per-QP RDMA/core: add rdma_rw_max_sge() helper for SQ sizing cxl: Fix premature commit_end increment on decoder commit failure mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions() mtd: spinand: Fix kernel doc power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() scsi: ufs: host: mediatek: Require CONFIG_PM scsi: csiostor: Fix dereference of null pointer rn nvdimm: virtio_pmem: serialize flush requests fs/nfs: Fix readdir slow-start regression tracing: Properly process error handling in event_hist_trigger_parse() tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings() fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs clk: qcom: rcg2: compute 2d using duty fraction directly clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc clk: qcom: gcc-ipq5018: flag sleep clock as critical clk: Move clk_{save,restore}_context() to COMMON_CLK section clk: qcom: dispcc-sdm845: Enable parents for pixel clocks clk: qcom: gfx3d: add parent to parent request map clk: mediatek: Fix error handling in runtime PM setup dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX dma: dma-axi-dmac: fix SW cyclic transfers staging: greybus: lights: avoid NULL deref serial: imx: change SERIAL_IMX_CONSOLE to bool serial: SH_SCI: improve "DMA support" prompt mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms iio: pressure: mprls0025pa: fix scan_type struct watchdog: starfive-wdt: Fix PM reference leak in probe error path coresight: etm3x: Fix cpulocked warning on cpuhp Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure mfd: simple-mfd-i2c: Add MAX77705 support mfd: simple-mfd-i2c: Add compatible strings for Layerscape QIXIS FPGA mfd: simple-mfd-i2c: Add SpacemiT P1 support mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order mfd: simple-mfd-i2c: Add Delta TN48M CPLD support UBUNTU: [Config] Disable new Delta TN48M CPLD support by default drivers: iio: mpu3050: use dev_err_probe for regulator request usb: bdc: fix sleep during atomic pinctrl: equilibrium: Fix device node reference leak in pinbank_init() ovl: Fix uninit-value in ovl_fill_real iio: sca3000: Fix a resource leak in sca3000_probe() pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition pinctrl: single: fix refcount leak in pcs_add_gpio_func() leds: qcom-lpg: Check the return value of regmap_bulk_write() backlight: qcom-wled: Support ovp values for PMI8994 backlight: qcom-wled: Change PM8950 WLED configurations dmaengine: fsl-edma: don't explicitly disable clocks in .remove() io_uring/cancel: de-unionize file and user_data in struct io_cancel_data fs/ntfs3: prevent infinite loops caused by the next valid being the same fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check kbuild: Add objtool to top-level clean target selftests/memfd: delete unused declarations selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO cpuidle: Skip governor when only one idle state is available selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2 net: sparx5/lan969x: fix DWRR cost max to match hardware register width net: mscc: ocelot: extract ocelot_xmit_timestamp() helper net: mscc: ocelot: split xmit into FDMA and register injection paths net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj() ipv6: Fix out-of-bound access in fib6_add_rt2node(). net: sparx5/lan969x: fix PTP clock max_adj value net: usb: catc: enable basic endpoint checking xen-netback: reject zero-queue configuration from guest net/rds: rds_sendmsg should not discard payload_len net: bridge: mcast: always update mdb_n_entries for vlan contexts selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled netfilter: nf_conntrack_h323: don't pass uninitialised l3num value net: remove WARN_ON_ONCE when accessing forward path array netfilter: nf_tables: fix use-after-free in nf_tables_addchain() ipv6: fix a race in ip6_sock_set_v6only() bpftool: Fix truncated netlink dumps ping: annotate data-races in ping_lookup() macvlan: observe an RCU grace period in macvlan_common_newlink() error path icmp: move icmp_global.credit and icmp_global.stamp to per netns storage icmp: icmp_msgs_per_sec and icmp_msgs_burst sysctls become per netns icmp: prevent possible overflow in icmp_global_allow() cache: add __cacheline_group_{begin, end}_aligned() (+ couple more) inet: move icmp_global_{credit,stamp} to a separate cache line octeontx2-af: Fix default entries mcam entry action bonding: alb: fix UAF in rlb_arp_recv during bond up/down net/mlx5: Fix multiport device check over light SFs apparmor: fix NULL sock in aa_sock_file_perm apparmor: return -ENOMEM in unpack_perms_table upon alloc failure apparmor: fix rlimit for posix cpu timers apparmor: remove apply_modes_to_perms from label_match apparmor: make label_match return a consistent value apparmor: fix invalid deref of rawdata when export_binary is unset apparmor: fix aa_label to return state from compount and component match drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc() drm/amdgpu: Fix memory leak in amdgpu_ras_init() drm/i915/acpi: free _DSM package when no connectors ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init drm/amdkfd: fix debug watchpoints for logical devices drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 spi: wpcm-fiu: Use devm_platform_ioremap_resource_byname() spi: wpcm-fiu: Fix uninitialized res spi: wpcm-fiu: Simplify with dev_err_probe() spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe() s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n efi: Fix reservation of unaccepted memory table btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found x86/hyperv: Fix error pointer dereference ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk drm/amd/display: Use same max plane scaling limits for all 64 bpp formats MIPS: Work around LLVM bug when gp is used as global register variable ext4: don't cache extent during splitting extent ext4: fix memory leak in ext4_ext_shift_extents() ext4: use optimized mballoc scanning regardless of inode format ata: pata_ftide010: Fix some DMA timings ata: libata-scsi: refactor ata_scsi_translate() SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names perf test stat: Update test expectations and events perf test stat tests: Fix for virtualized machines perf unwind-libdw: Fix invalid reference counts perf callchain: Fix srcline printing with inlines libsubcmd: Fix null intersection case in exclude_cmds() libperf: Don't remove -g when EXTRA_CFLAGS are used libperf build: Always place libperf includes first rtc: interface: Alarm race handling should not discard preceding error audit: add fchmodat2() to change attributes class hfsplus: fix volume corruption issue for generic/498 fs/buffer: add alert in try_to_free_buffers() for folios without buffers audit: add missing syscalls to read class hfsplus: pretend special inodes as regular files i3c: master: svc: Initialize 'dev' to NULL in svc_i3c_master_ibi_isr() minix: Add required sanity checking to minix_check_superblock() btrfs: handle user interrupt properly in btrfs_trim_fs() smb: client: add proper locking around ses->iface_last_update gfs2: fiemap page fault fix smb: client: prevent races in ->query_interfaces() tools/power cpupower: Reset errno before strtoull() s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS perf/arm-cmn: Support CMN-600AE arm64: Add support for TSV110 Spectre-BHB mitigation rnbd-srv: Zero the rsp buffer before using it x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set EFI/CPER: don't dump the entire memory region APEI/GHES: ensure that won't go past CPER allocated record EFI/CPER: don't go past the ARM processor CPER record buffer ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP md-cluster: fix NULL pointer dereference in process_metadata_update cpufreq: dt-platdev: Block the driver from probing on more QC platforms s390/perf: Disable register readout on sampling events perf/cxlpmu: Replace IRQF_ONESHOT with IRQF_NO_THREAD xenbus: Use .freeze/.thaw to handle xenbus devices blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() sparc: Synchronize user stack on fork and clone sparc: don't reference obsolete termio struct for TC* constants bpf: verifier improvement in 32bit shift sign extension pattern clocksource/drivers/sh_tmu: Always leave device running after probe clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF PCI/MSI: Unmap MSI-X region on error crypto: hisilicon/qm - move the barrier before writing to the mailbox register mailbox: bcm-ferxrm-mailbox: Use default primary handler char: tpm: cr50: Remove IRQF_ONESHOT pstore: ram_core: fix incorrect success return when vmap() fails arm64: tegra: smaug: Add usb-role-switch support parisc: Prevent interrupts during reboot drm/display/dp_mst: Add protection against 0 vcpi spi-geni-qcom: initialize mode related registers to 0 spi-geni-qcom: use xfer->bits_per_word for can_dma() media: dvb-core: dmxdevfilter must always flush bufs spi: stm32: fix Overrun issue at < 8bpw drm/v3d: Set DMA segment size to avoid debug warnings media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes media: omap3isp: isppreview: always clamp in preview_try_format() media: omap3isp: set initial format media: mediatek: vcodec: Don't try to decode 422/444 VP9 drm/amdgpu: add support for HDP IP version 6.1.1 drm/amdgpu: avoid a warning in timedout job handler HID: apple: Add "SONiX KN85 Keyboard" to the list of non-apple keyboards ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask ASoC: wm8962: Don't report a microphone if it's shorted to ground on plug spi: spi-mem: Limit octal DTR constraints to octal DTR situations media: amphion: Clear last_buffer_dequeued flag for DEC_CMD_START media: adv7180: fix frame interval in progressive mode media: pvrusb2: fix URB leak in pvr2_send_request_ex media: solo6x10: Check for out of bounds chip_id media: cx25821: Fix a resource leak in cx25821_dev_setup() media: v4l2-async: Fix error handling on steps after finding a match drm/amdkfd: Fix GART PTE for non-4K pagesize in svm_migrate_gart_map() drm: Account property blob allocations to memcg hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed virt: vbox: uapi: Mark inner unions in packed structs as packed drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release media: rkisp1: Fix filter mode register configuration HID: multitouch: add eGalaxTouch EXC3188 support HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK ALSA: hda/conexant: Add headset mic fix for MECHREVO Wujie 15X Pro gpio: aspeed-sgpio: Change the macro to support deferred probe ASoC: sunxi: sun50i-dmic: Add missing check for devm_regmap_init_mmio spi: spi-mem: Protect dirmap_create() with spi_mem_access_start/end ASoC: codecs: max98390: Check return value of devm_gpiod_get_optional() in max98390_i2c_probe() hwmon: (nct6775) Add ASUS Pro WS WRX90E-SAGE SE hwmon: (f71882fg) Add F81968 support ASoC: es8328: Add error unwind in resume modpost: Amend ppc64 save/restfpr symnames for -Os build ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio jfs: Add missing set_freezable() for freezable kthread jfs: nlink overflow in jfs_rename wifi: rtw88: fix DTIM period handling when conf->dtim_period is zero wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() wifi: rtw88: rtw8821cu: Add ID for Mercusys MU6H dm: replace -EEXIST with -EBUSY dm: remove fake timeout to avoid leak request iommu/arm-smmu-v3: Improve CMDQ lock fairness and efficiency wifi: libertas: fix WARNING in usb_tx_block iommu/amd: move wait_on_sem() out of spinlock wifi: rtw89: wow: add reason codes for disassociation in WoWLAN mode PCI: dw-rockchip: Disable BAR 0 and BAR 1 for Root Port wifi: ath11k: add pm quirk for Thinkpad Z13/Z16 Gen1 wifi: ath12k: fix preferred hardware mode calculation ipv6: annotate data-races in ip6_multipath_hash_{policy,fields}() ipv6: exthdrs: annotate data-race over multiple sysctl ext4: mark group add fast-commit ineligible ext4: move ext4_percpu_param_init() before ext4_mb_init() ext4: mark group extend fast-commit ineligible netfilter: nf_conntrack: Add allow_clash to generic protocol handler netfilter: xt_tcpmss: check remaining length before reading optlen openrisc: define arch-specific version of nop() net: usb: r8152: fix transmit queue timeout wifi: iwlwifi: mvm: check the validity of noa_len net/rds: No shortcut out of RDS_CONN_ERROR gro: change the BUG_ON() in gro_pull_from_frag0() ipv4: igmp: annotate data-races around idev->mr_maxdelay net: hns3: extend HCLGE_FD_AD_QID to 11 bits wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() ipv4: fib: Annotate access to struct fib_alias.fa_state. Bluetooth: hci_conn: Set link_policy on incoming ACL connections Bluetooth: hci_conn: use mod_delayed_work for active mode timeout Bluetooth: btusb: Add new VID/PID for RTL8852CE Bluetooth: btusb: Add device ID for Realtek RTL8761BU octeontx2-af: Workaround SQM/PSE stalls by disabling sticky wifi: rtw89: pci: restore LDO setting after device resume wifi: ath10k: fix lock protection in ath10k_wmi_event_peer_sta_ps_state_chg() net: usb: sr9700: remove code to drive nonexistent multicast filter vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 net/rds: Clear reconnect pending bit PCI: Mark ASM1164 SATA controller to avoid bus reset PCI: Fix pci_slot_lock () device locking PCI: Enable ACS after configuring IOMMU for OF platforms PCI: Add ACS quirk for Qualcomm Hamoa & Glymur PCI: Mark Nvidia GB10 to avoid bus reset myri10ge: avoid uninitialized variable use nfc: nxp-nci: remove interrupt trigger type RDMA/rtrs-clt: For conn rejection use actual err number ata: libata: avoid long timeouts on hot-unplugged SATA DAS hisi_acc_vfio_pci: update status after RAS error scsi: buslogic: Reduce stack usage vhost: fix caching attributes of MMIO regions by setting them explicitly tracing: Fix false sharing in hwlat get_sample() remoteproc: imx_dsp_rproc: Skip RP_MBOX_SUSPEND_SYSTEM when mailbox TX channel is uninitialized mailbox: pcc: Remove spurious IRQF_ONESHOT usage mailbox: imx: Skip the suspend flag for i.MX7ULP mailbox: sprd: mask interrupts that are not handled remoteproc: mediatek: Break lock dependency to `prepare_lock` mailbox: sprd: clear delivery flag before handling TX done clk: microchip: core: correct return value on *_get_parent() m68k: nommu: fix memmove() with differently aligned src and dest for 68000 soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) staging: rtl8723bs: fix missing status update on sdio_alloc_irq() failure serial: 8250_dw: handle clock enable errors in runtime_resume usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs fpga: of-fpga-region: Fail if any bridge is missing dmaengine: sun6i: Choose appropriate burst length under maxburst dmaengine: stm32-mdma: initialize m2m_hw_period and ccr to fix warnings misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read() misc: eeprom: Fix EWEN/EWDS/ERAL commands for 93xx56 and 93xx66 staging: rtl8723bs: fix memory leak on failure path serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done fix it87_wdt early reboot by reporting running timer binder: don't use %pK through printk watchdog: imx7ulp_wdt: handle the nowayout option phy: mvebu-cp110-utmi: fix dr_mode property read from dts phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature Revert "mfd: da9052-spi: Change read-mask to write-mask" iio: Use IRQF_NO_THREAD iio: magnetometer: Remove IRQF_ONESHOT MIPS: Loongson: Make cpumask_of_node() robust against NUMA_NO_NODE fs: ntfs3: check return value of indx_find to avoid infinite loop fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST fs/ntfs3: drop preallocated clusters for sparse and compressed files fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra() ceph: supply snapshot context in ceph_uninline_data() libceph: define and enforce CEPH_MAX_KEY_LEN thermal: int340x: Fix sysfs group leak on DLVR registration failure include: uapi: netfilter_bridge.h: Cover for musl libc ARM: 9467/1: mm: Don't use %pK through printk drm/amd/display: Avoid updating surface with the same surface under MPO drm/amdgpu: Adjust usleep_range in fence wait ALSA: usb-audio: Update the number of packets properly at receiving drm/amdgpu: Add HAINAN clock adjustment drm/radeon: Add HAINAN clock adjustment ALSA: usb-audio: Add sanity check for OOB writes at silencing btrfs: replace BUG() with error handling in __btrfs_balance() drm/amd/display: Remove conditional for shaper 3DLUT power-on rtc: zynqmp: correct frequency value ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut xfrm6: fix uninitialized saddr in xfrm6_get_saddr() xfrm: skip templates check for packet offload tunnel mode ipmi: ipmb: initialise event handler read bytes xfrm: always flush state and policy upon NETDEV_UNREGISTER event net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode net: usb: lan78xx: scan all MDIO addresses on LAN7801 net: ixp4xx_eth: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() net: ethernet: xscale: Check for PTP support properly wifi: cfg80211: wext: fix IGTK key ID off-by-one Remove WARN_ALL_UNSEEDED_RANDOM kernel config option UBUNTU: [Config] Remove WARN_ALL_UNSEEDED_RANDOM Bluetooth: L2CAP: Fix invalid response to L2CAP_ECRED_RECONF_REQ Bluetooth: hci_qca: Cleanup on all setup failures Bluetooth: L2CAP: Fix response to L2CAP_ECRED_CONN_REQ Bluetooth: L2CAP: Fix not checking output MTU is acceptable on L2CAP_ECRED_CONN_REQ Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ tipc: fix duplicate publication key in tipc_service_insert_publ() RDMA/core: Fix stale RoCE GIDs during netdev events at registration net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets RDMA/efa: Fix typo in efa_alloc_mr() net: usb: pegasus: enable basic endpoint checking RDMA/umem: Fix double dma_buf_unpin in failure path net/mlx5: DR, Fix circular locking dependency in dump net/mlx5: Fix missing devlink lock in SRIOV enable error path net: consume xmit errors of GSO frames dpaa2-switch: validate num_ifs to prevent out-of-bounds write netfilter: nf_conntrack_h323: fix OOB read in decode_choice() rpmsg: core: fix race in driver_override_show() and use core helper clk: renesas: rzg2l: Fix intin variable size clk: renesas: rzg2l: Select correct div round macro ASoC: SOF: ipc4-control: If there is no data do not send bytes update ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data ASoC: SOF: ipc4-control: Keep the payload size up to date fpga: dfl: use subsys_initcall to allow built-in drivers to be added dm-verity: correctly handle dm_bufio_client_create() failure media: mediatek: encoder: Fix uninitialized scalar variable issue media: mtk-mdp: Fix error handling in probe function media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() media: verisilicon: AV1: Fix enable cdef computation media: verisilicon: AV1: Fix tx mode bit setting ARM: omap2: Fix reference count leaks in omap_control_init() KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding arm64: Disable branch profiling for all arm64 code HID: hid-pl: handle probe errors HID: magicmouse: Do not crash on missing msc->input HID: prodikeys: Check presence of pm->input_ep82 HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() arm64: dts: apple: t8112-j473: Keep the HDMI port powered on media: verisilicon: AV1: Set IDR flag for intra_only frame type media: radio-keene: fix memory leak in error path media: cx88: Add missing unmap in snd_cx88_hw_params() media: cx23885: Add missing unmap in snd_cx23885_hw_params() media: cx25821: Add missing unmap in snd_cx25821_hw_params() media: i2c/tw9903: Fix potential memory leak in tw9903_probe() media: i2c/tw9906: Fix potential memory leak in tw9906_probe() media: i2c: ov01a10: Fix the horizontal flip control media: i2c: ov01a10: Fix reported pixel-rate value media: i2c: ov01a10: Fix analogue gain range media: i2c: ov01a10: Add missing v4l2_subdev_cleanup() calls media: i2c: ov01a10: Fix test-pattern disabling media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() media: ccs: Avoid possible division by zero media: i2c: ov5647: Initialize subdev before controls media: i2c: ov5647: Correct pixel array offset media: i2c: ov5647: Correct minimum VBLANK value media: i2c: ov5647: Sensor should report RAW color space media: i2c: ov5647: Fix PIXEL_RATE value for VGA mode media: i2c: ov5647: use our own mutex for the ctrl lock dm-integrity: fix a typo in the code for write/discard race dm: clear cloned request bio pointer when last clone bio completes soc: ti: k3-socinfo: Fix regmap leak on probe failure soc: ti: pruss: Fix double free in pruss_clk_mux_setup() KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation clk: clk-apple-nco: Add "apple,t8103-nco" compatible media: i2c: ov01a10: Fix digital gain range clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() s390/pci: Handle futile config accesses of disabled devices directly dm-integrity: fix recalculation in bitmap mode dm-unstripe: fix mapping bug when there are multiple targets in a table arm64: dts: rockchip: Do not enable hdmi_sound node on Pinebook Pro media: venus: vdec: fix error state assignment for zero bytesused media: venus: vdec: restrict EOS addr quirk to IRIS2 only drm: of: drm_of_panel_bridge_remove(): fix device_node leak mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations selftests/mm/charge_reserved_hugetlb: drop mount size for hugetlbfs xfs: mark data structures corrupt on EIO and ENODATA media: verisilicon: AV1: Fix tile info buffer size iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode mfd: core: Add locking around 'mfd_of_node_list' xfs: delete attr leaf freemap entries when empty xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs: fix remote xattr valuelblk check KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions md/bitmap: fix GPF in write_page caused by resize race nfsd: fix return error code for nfsd_map_name_to_[ug]id nvmem: Drop OF node reference on nvmem_add_one_cell() failure usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN bus: fsl-mc: fix an error handling in fsl_mc_device_add() dm mpath: make pg_init_delay_msecs settable tools: Fix bitfield dependency failure powerpc/smp: Add check for kcalloc() failure in parse_thread_groups() iio: gyro: itg3200: Fix unchecked return value in read_raw mm/highmem: fix __kmap_to_page() build error rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() ocfs2: fix reflink preserve cleanup issue kexec: derive purgatory entry from symbol Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" PCI/IOV: Fix race between SR-IOV enable/disable and hotplug arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y btrfs: continue trimming remaining devices on failure remoteproc: imx_rproc: Fix invalid loaded resource table detection perf/arm-cmn: Reject unsupported hardware configurations scsi: ufs: core: Flush exception handling work when RPM level is zero usb: dwc3: gadget: Move vbus draw to workqueue context usb: dwc2: fix resume failure if dr_mode is host mtd: rawnand: pl353: Fix software ECC support tipc: fix RCU dereference race in tipc_aead_users_dec() drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() net: cpsw_new: Fix unnecessary netdev unregistration in cpsw_probe() error path PCI: Fix pci_slot_trylock() error handling parisc: kernel: replace kfree() with put_device() in create_tree_node() staging: rtl8723bs: fix null dereference in find_network cifs: Fix locking usage for tcon fields MIPS: rb532: Fix MMIO UART resource registration ceph: supply snapshot context in ceph_zero_partial_object() LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE LoongArch: Prefer top-down allocation after arch_mem_init() LoongArch: Guard percpu handler under !CONFIG_PREEMPT_RT LoongArch: Disable instrumentation for setup_ptwalker() net: ethernet: marvell: skge: remove incorrect conflicting PCI ID net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() octeontx2-af: CGX: fix bitmap leaks net: macb: Fix tx/rx malfunction after phy link down and up tracing: Fix to set write permission to per-cpu buffer_size_kb io_uring/filetable: clamp alloc_hint to the configured alloc range net: intel: fix PCI device ID conflict between i40e and ipw2200 atm: fore200e: fix use-after-free in tasklets during device removal ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() fbcon: check return value of con2fb_acquire_newinfo() fbdev: vt8500lcdfb: fix missing dma_free_coherent() fbdev: of: display_timing: fix refcount leak in of_get_display_timings() fbdev: ffb: fix corrupted video output on Sun FFB1 fbcon: Remove struct fbcon_display.inverse cifs: some missing initializations on replay ASoC: amd: yc: Add DMI quirk for ASUS Vivobook Pro 15X M6501RR net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() x86/kexec: Copy ACPI root pointer address from config table arm64: Force the use of CNTVCT_EL0 in __delay() net: nfc: nci: Fix parameter validation for packet data tracing: Fix checking of freed trace_event_file for hist files tracing: Wake up poll waiters for hist files when removing an event NTB: ntb_transport: Fix too small buffer for debugfs_name drm/i915/wakeref: clean up INTEL_WAKEREF_PUT_* flag macros arm64: Fix sampling the "stable" virtual counter in preemptible section gfs2: Fix slab-use-after-free in qd_put io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature OPP: Return correct value in dev_pm_opp_get_level cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id() perf/x86/core: Do not set bit width for unavailable counters genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). platform/x86: int0002: Remove IRQF_ONESHOT from request_irq() media: pci: mg4b: Use IRQF_NO_THREAD firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147 arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models) media: chips-media: wave5: Fix memory leak on codec_info allocation failure drm/amd: Drop "amdgpu kernel modesetting enabled" message drm/amdkfd: Fix signal_eviction_fence() bool return value drm/xe: Unregister drm device on probe error HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients wifi: cfg80211: Fix use_for flag update on BSS refresh PCI: Check parent for NULL in of_pci_bus_release_domain_nr() netfilter: nfnetlink_queue: optimize verdict lookup with hash table netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed() power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed() RDMA/mlx5: Fix UMR hang in LAG error state unload IB/mlx5: Fix port speed query for representors platform/x86/amd/pmf: Prevent TEE errors after hibernate crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue iio: pressure: mprls0025pa: fix interrupt flag objpool: fix the overestimation of object pooling metadata size ipvs: do not keep dest_dst if dev is going down net/mlx5e: Use unsigned for mlx5e_get_max_num_channels AppArmor: Allow apparmor to handle unaligned dfa tables apparmor: Fix & Optimize table creation from possibly unaligned memory apparmor: avoid per-cpu hold underflow in aa_get_buffer drm/amd/display: Fix out-of-bounds stream encoder index v3 btrfs: use the correct type to initialize block reserve for delayed refs Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT i3c: mipi-i3c-hci: Reset RING_OPERATION1 fields during init APEI/GHES: ARM processor Error: don't go past allocated memory ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[] powercap: intel_rapl: Add PL4 support for Ice Lake alpha: fix user-space corruption during memory compaction ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) ACPI: battery: fix incorrect charging status when current is zero perf/x86/msr: Add Airmont NP perf/x86/cstate: Add Airmont NP bpf: Recognize special arithmetic shift in the verifier firmware: arm_ffa: Unmap Rx/Tx buffers on init failure gpu/panel-edp: add AUO panel entry for B140HAN06.4 drm/amdgpu: fix NULL pointer issue buffer funcs ASoC: SOF: ipc4: Support for sending payload along with LARGE_CONFIG_GET media: chips-media: wave5: Fix conditional in start_streaming media: chips-media: wave5: Process ready frames when CMD_STOP sent to Encoder drm/amd/display: Fix dsc eDP issue drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() media: mt9m114: Avoid a reset low spike during probe() media: mt9m114: Return -EPROBE_DEFER if no endpoint is found ALSA: hda/realtek: add HP Victus 16-e0xxx mute LED quirk PCI: Add Intel Nova Lake audio Device ID drm/amd/display: Disable FEC when powering down encoders drm/amd/display: avoid dig reg access timeout on usb4 link training fail hwmon: (dell-smm) Add support for Dell OptiPlex 7080 HID: logitech-hidpp: Add support for Logitech K980 ASoC: SOF: Intel: hda: Fix NULL pointer dereference spi: geni-qcom: Fix abort sequence execution for serial engine errors ALSA: hda/realtek - Enable mute LEDs on HP ENVY x360 15-es0xxx wifi: rtw89: 8922a: set random mac if efuse contains zeroes wifi: rtw89: ser: enable error IMR after recovering from L1 wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() wifi: rtw89: mac: correct page number for CSI response wifi: ath11k: Fix failure to connect to a 6 GHz AP ipv6: annotate data-races over sysctl.flowlabel_reflect ext4: use reserved metadata blocks when splitting extent on endio Bluetooth: btusb: Add support for MediaTek7920 0489:e158 net: sfp: add quirk for Lantech 8330-265D PCI/AER: Clear stale errors on reporting agents upon probe scsi: ufs: mediatek: Fix page faults in ufs_mtk_clk_scale() trace event riscv: vector: init vector context with proper vlenb HID: i2c-hid: Add FocalTech FT8112 9p/xen: protect xen_9pfs_front_free against concurrent calls soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list most: remove usage of the deprecated ida_simple_xx() API most: core: fix resource leak in most_register_interface error paths usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() serial: 8250: 8250_omap.c: Add support for handling UART error conditions mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs ACPI: x86: Force enabling of PWM2 on the Yogabook YB1-X90 drm/amd/display: Fix writeback on DCN 3.2+ drm/amd/display: Fix system resume lag issue drm/amd/display: bypass post csc for additional color spaces in dal spi: spidev: fix lock inversion between spi_lock and buf_lock Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short kcm: fix zero-frag skb in frag_list on partial sendmsg error net/mlx5: E-switch, Clear legacy flag when moving to switchdev net/mlx5e: Separate address related variables to be in struct net/mlx5e: Support routed networks during IPsec MACs initialization net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query drm/tests: shmem: Swap names of export tests KVM: x86: Return "unsupported" instead of "invalid" on access to unsupported PV MSR media: amphion: Drop min_queued_buffers assignment media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() media: i2c: ov01a10: Fix passing stream instead of pad to v4l2_subdev_state_get_format() media: ccs: Fix setting initial sub-device state platform/x86: ISST: Add missing write block check bus: omap-ocp2scp: fix OF populate on driver rebind media: stm32: dcmipp: bytecap: clear all interrupts upon stream stop drm/buddy: Prevent BUG_ON by validating rounded allocation xfs: remove xfs_attr_leaf_hasname mfd: qcom-pm8xxx: Fix OF populate on driver rebind mfd: omap-usb-host: Fix OF populate on driver rebind xfs: fix the xattr scrub to detect freemap/entries array collisions pinctrl: intel: Add code name documentation xfs: check for deleted cursors when revalidating two btrees vhost: move vdpa group bound check to vhost_vdpa clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 mm/slab: use unsigned long for orig_size to ensure proper metadata align drm/amd/display: Increase DCN35 SR enter/exit latency drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify mm: numa_memblks: Identify the accurate NUMA ID of CFMW drm/amdgpu: keep vga memory on MacBooks with switchable graphics most: core: fix leak on early registration failure Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req UBUNTU: Upstream stable to v6.6.128, v6.12.75 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2150809/+subscriptions
Комментариев нет:
Отправить комментарий