[Bug 2169638] Re: Resolute update: upstream stable patchset 2026-10-05

drm/amd/display: Fix backlight max_brightness to match exported range drm/amd/display: Scale custom brightness curve from full range batman-adv: dat: atomically update mac addresses batman-adv: bla: avoid CRC corruption due to parallel claim add i3c: master: Fix device_register() error path tracing/probes: ignore id update from btf_type_skip_modifiers udf: Move udf_map_block() up nvdimm: preserve flush callback -ENOMEM i3c: master: Fix recursive locking during device registration tracing/probes: Fix BTF kflag check for anonymous struct member access udf: Fix data loss when converting inline inodes to out of line futex: Optimize futex hash bucket access patterns nvdimm: pmem: keep PREFLUSH before data writes nvdimm: virtio_pmem: stop allocating child flush bio nvdimm: virtio_pmem: always wake -ENOSPC waiters nvdimm: virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags nvdimm: virtio_pmem: refcount requests for token lifetime clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs i3c: master: Do not treat master device as a duplicate target i3c: master: Fix use-after-free of master->this mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP platform/x86: hp-wmi: Add support for OMEN MAX 16-ak0xxx (8DD6) staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit() dm-pcache: reject a kset that overruns its segment dm-pcache: bound the logical key offset from persistent memory dm-pcache: validate the persisted dirty_tail chain at load KVM: x86: Disallow EFER.LME and EFER.LMA if long mode is not supported KVM: x86: Extract REGS and SREGS runtime sync code to helpers KVM: x86: Rename __{g,s}et_sregs2() => kvm_vcpu_ioctl_x86_{g,s}et_sregs2() KVM: x86: Move the bulk of register specific code from x86.c to regs.c KVM: x86: Check EFER validity on KVM_SET_SREGS* Smack: Fix error in capability bypass drm: Remove unused header in drm_dumb_buffers.c drm: lcdif: Wait for vblank before disabling DMA drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel drm/bridge: synopsys: dw-dp: Set pixel mode by platform data drm/rockchip: dw_dp: Simplify error handling drm/rockchip: dw_dp: Add missing newline in dev_err_probe() message drm/rockchip: dw_dp: Release core resources drm/rockchip: vop2: Fix wrong wait target in layer cfg done check drm/rockchip: vop2: Wait for layer cfg done before switching LAYERSEL_REGDONE_SEL drm/rockchip: analogix_dp: Enable hclk for RK3588 drm/rockchip: analogix_dp: Fix OF node reference leak via auto cleanup drm/bridge: display-connector: don't autoenable HPD IRQ drm/bridge: display-connector: trigger initial HPD event for DP drm/v3d: Clear queue->active_job when v3d_fence_create() fails drm/rockchip: vop2: Add RK3576 to the RG swap special case drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format drm/bridge: cdns-dsi: Return an error pointer on allocation failure drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure smack: fix incorrect task context in smack_msg_queue_msgrcv smack: simplify write handlers of sysfs entries smack: deduplicate smackfs/{direct,mapped} file_operations smack: restrict smackfs/{direct,mapped} values to 0-255 sched_ext/scx_flatcg: Fix cvtime_delta race and add hweight scaling to bypass charging x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE() platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count selftests: proc: include fcntl.h in proc-pidns HID: core: quiesce input in hid_hw_stop() to prevent use-after-free HID: nintendo: Fix imu_timestamp_us double increment per report HID: roccat: bound device-supplied profile index soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() media: cec-pin: Fix event FIFO ordering cxl/mbox: Clamp mailbox output allocation to the payload size cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox() clk: versaclock7: Fix APLL clock leak on probe failure clk: moxart: remove unused variables, fix refcount leak clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic clk: stm32: add missing bitfield.h header ASoC: rt700-sdw: always drain jack work on remove ASoC: fsl_audmix: rework runtime PM handling in probe clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller ARM: imx: fix device_node refcount leak in imx_src_init() ARM: imx: fix device_node refcount leaks in imx7_src_init() arm64: dts: imx93-kontron: set memory node to 0x80000000/1GiB clk: imx: scu: drop redundant init.ops variable assignment drm/lima: call drm_mm_init() with a valid allocation range mm/mm_init: fix incorrect node_spanned_pages sched/fair: Fix overflow in update_tg_cfs_runnable() perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails pinctrl: bcm2835: Don't remove an unregistered GPIO chip riscv: kexec_file: Fix crashk_low_res not exclude bug media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define wifi: ath12k: correct monitor destination ring size perf test: Drain pipe after child finishes to avoid losing output perf test: Refactor parallel poll loop to drain all pipes simultaneously perf test: Show snippet failure output for verbose=1 perf test: Add summary reporting perf test: Fix subtest status alignment for multi-digit indexes perf test: Add -j/--junit option for JUnit XML test reports perf test: Truncate printed test descriptions dynamically to avoid terminal wrapping perf test: Truncate test description to fit terminal width perf tests: Skip metrics validation if system-wide recording lacks permission perf tests: Add robust record retry helper and use subsecond workloads perf tests: Fix flakiness in trace record and replay test perf test: Fix perf stat --bpf-counters on hybrid machines perf tests: Fix flakiness in BPF counters test on hybrid systems perf test: Fixes for check branch stack sampling perf tests: Fix flakiness in branch stack sampling tests regulator: tps6594: Fix device node reference leaks in multiphase loop drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup tools/bpf/bpftool: Reset vmlinux BTF after map commands tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands bpf: Copy per-CPU map value padding in copy_map_value_long() selftests/bpf: Mask socket type flags in mptcpify prog bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks mm: name the anonymous MMOP enum as enum mmop mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers dmaengine: zynqmp_dma: fix race between runtime PM and device removal dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe soundwire: qcom: Fix port exhaustion check in stream_alloc_ports iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure csky: Fix a4/a5 restoration in syscall trace path selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check platform/chrome: sensorhub: Fix memory overread in ring handler wifi: rtw89: check return values in rtw89_ops_start_ap() wifi: rtw89: fix HE extended capability length check fanotify: initialize permission event watchdog state tools/nolibc: mark arg1 operand in __nolibc_syscall0() as write-only perf cs-etm: Fix thread leaks on trace queue init failure perf/x86/amd/uncore: Add group validation perf vendor events amd: Update Zen 5 core events hwrng: core - fix rng list on registration error crypto: qat - cancel work on re-enable SR-IOV timeout crypto: qat - clear AES key schedule from stack crypto: atmel-ecc - reject hardware ECDH without a public key crypto: atmel-sha204a - fix heap info leak on I2C transfer failure crypto: sa2ul - stop probe if context pool creation fails hwrng: xilinx-trng - propagate timeout before any data is read crypto: rk3288 - fail ahash requests on HASH idle timeout crypto: keembay - Fix AEAD unregister count in error path RDMA/irdma: Deduplicate the irdma_del_memlist logic RDMA/irdma: Add a refcount to track user ring MR associations RDMA/irdma: Add irdma_cq fields to track pbl allocations RDMA/irdma: Add refcounting to user ring MRs arm64: dts: qcom: sm8750: wire UFS to ice instance nvme-apple: Use acquire/release for queue enabled state nvmet-rdma: factor out response resource cleanup nvmet-rdma: fix response resource leak on queue teardown bus: ti-sysc: Fix /chosen node reference leak PM: sleep: Fix off-by-one in wakelocks number limit check cgroup/cpuset: Make nr_deadline_tasks an atomic_t arm64: dts: qcom: sc8280xp-blackrock: switch to uefi rtc offset arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name arm64: dts: qcom: hamoa: Fix clocks for HSPHYs clk: qcom: gcc-glymur: Move EVA clocks to critical clock list bus: qcom-ebi2: Fix clock leak on probe failure wifi: mac80211_hwsim: avoid NULL skb in stop queue drain staging: greybus: audio: correct sscanf() return value check staging: sm750fb: gate dualview dataflow using g_dualview staging: sm750fb: Add missing Kconfig dependency greybus: audio: bound the topology section sizes against the fetched size staging: fbtft: Use sysfs_emit_at() to print to sysfs file staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions staging: octeon: replace pr_warn with dev_warn in fill and rx paths staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() selftests/bpf: Fix memory leak in msg_alloc_iov error path selftests/bpf: Fix memory leak in msg_alloc_iov selftests/lsm: Fix memory leak in attr_lsm_count irqchip/gic-v3-its: Fix memleak in its_probe_one() irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its() selftests: timers: leap-a-day: Fix -w option and update usage comment clocksource: Unregister subsystem on device registration failure timekeeping: Unwind aux clock sysfs children on failure timers/migration: Fix memory leak in tmigr_setup_groups() error path vdso/timens: Move functions to new file timens: Add a __free() wrapper for put_time_ns() timens: Simplify some calls to put_time_ns() time/namespace: Validate nanosecond field in proc_timens_set_offset() y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 timekeeping: Account for monotonicity adjustment in ntp_error arm64: dts: qcom: Add #{address,size}-cells to Chromium-based /firmware clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() arm64: dts: qcom: sc8280xp-arcata: Fix top USB-C DP alt mode arm64: dts: qcom: sc8180x-primus: Rename regulator nodes arm64: dts: qcom: sc8180x-primus: Describe the display power net arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power net clk: qcom: gcc-qcs8300: Use retention for PCIe power domains clk: qcom: gcc-qcs8300: Use retention for USB power domains perf data convert json: Fix trace_seq memory leak in process_sample_event() staging: media: ipu7: fix pm_runtime refcount leak in ipu7_init_fw_code_region_by_sys() staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume() thermal/drivers/rcar: Fix error checking in probe() usb: typec: ucsi: unregister debugfs entries on teardown usb: gadget: r8a66597: avoid double free of ep0_req in probe error path udf: Mark LVID buffer as uptodate before marking it dirty bpftool: Check EVP_Digest when computing excl_prog_hash perf vendor events amd: Reintroduce deprecated Zen 5 core events perf dso: Fix kallsyms DSO detection with fallback logic bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux efi: fix stale reference to efi_recover_from_page_fault() bpf: Fix use-after-free on mm_struct in bpf_find_vma() bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX bpf: Fix security_bpf_map_create error handling iommu/msm: Return -ENOMEM on memory allocation failure in probe iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors iommu/amd: Add support for Hygon family 18h model 4h IOAPIC iommu/amd: Fix false positive in SB IOAPIC IVRS validation leds: pca9532: Fix inverted GPIO output polarity leds: st1202: Stop pattern sequence before reprogramming leds: st1202: Fix pattern duration prescaler and pattern_clear skip marker leds: st1202: Fix spurious pattern sequence start in setup leds: st1202: Set all pattern PWM slots to full after clearing pattern leds: st1202: Fix brightness having no effect while pattern mode is active leds: st1202: Disable channel when brightness is set to zero leds: st1202: Validate LED reg property against channel count printk: Fix possible console use-after-free ACPI: RISC-V: Fix riscv_acpi_irq_get_dep() loop termination ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep() ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling platform/x86: dell-privacy: Fix race condition platform/x86: dell-wmi-base: Fix resource leak on module load failure platform/x86: lg-laptop: Drop debug-only ACPI notify handler platform/x86: lg-laptop: Convert ACPI driver to a platform one platform/x86: lg-laptop: Fix LED resource handling remoteproc: qcom_q6v5_adsp: Fix reference leak for device node hwspinlock: propagate errno when registering single lock selftests/sched_ext: Fix bpf_link leak on early return in prog_run perf capstone: Fix kernel map reference count leak spi: qcom-geni: Fix missing error check on pm_runtime_get_sync() serial: core: Add dedicated uart_port field for console flow serial: Replace driver usage of UPF_CONS_FLOW serial: 8250: Set cons_flow on port registration serial: 8250: Add support for console flow control serial: 8250: Clear CON_PRINTBUFFER on port re-registration serial: ma35d1: Fix OF node reference leaks in console init serial: qcom-geni: do not advance stale DMA completions usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths usb: gadget: configfs: fix out-of-bounds read of qw_sign usb: ljca: bound bank_num in ljca_enumerate_gpio() usb: gadget: aspeed_udc: check endpoint DMA allocation usb: fix UAF when probe runs concurrent to dyn ID removal platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL platform/surface: acpi-notify: Check ACPI companion before use usb: mtu3: allow system suspend during active gadget connection usb: renesas_usbhs: Fix power-off ordering on unbind usb: ucsi: huawei_gaokun: support mode switching usb: typec: ucsi: gaokun: unwind notifier on UCSI register failure drm/panel: samsung-s6d16d0: Power off on prepare failure perf metricgroup: Fix metric expression copy leaks soc: qcom: rpmh-rsc: manage PM notifiers with devres bus: qcom-ebi2: use managed resources for clocks and children clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK bpf: Require a BPF cpumask for bpf_cpumask_populate() wifi: rtw89: mlo: rearrange MLSR link decision flow wifi: rtw89: phy: support per PHY RX statistics wifi: rtw89: 8852a: fix RSSI report when average beacon RSSI is not ready iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE RDMA/core: Wait for RCU callbacks before unloading ib_core RDMA/mlx5: Drain RCU callbacks during module teardown RDMA/ipoib: Drain RCU callbacks during module teardown RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state drm/msm/dp: add missing drm_edid_connector_update() before add_modes on cached EDID Revert "drm/msm: dsi: fix PLL init in bonded mode" crypto: ccp - Fix memory leak in SEV INIT_EX path hwrng: ks-sa - Fix runtime PM cleanup on registration failure crash_dump: release keyring reference at the correct time xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full ALSA: hpi: Check transport errors during HPI6000 adapter initialization pmdomain: bcm: bcm2835: handle genpd provider registration errors misc: rtsx_usb: avoid USB I/O in runtime autosuspend RDMA/hfi1: Preserve unit 0 on allocation failure RDMA/hfi1: Free RX data on late probe failure RDMA/hfi1: Stop flushing the global IB workqueue RDMA/hfi1: Initialize debugfs after probe completes ASoC: apple: mca: increase SERDES reset delay isofs: fix out-of-bounds page array access on empty zisofs block iommufd/selftest: Avoid selftest dirty bitmap size wrap media: v4l2-async: Unregister sub-device if asc_list is empty fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() perf zstd: Fix compression error path in zstd_compress_stream_to_records() perf record: Return the written size from process_comp_header() perf record: Fix multiple PERF_RECORD_COMPRESSED2 records per push rpmsg: glink: fix deadlock in endpoint destroy during driver detach iommufd: Simplify iommufd_device_remove_vdev() cxl/memdev: Fix firmware upload exact-fit handling cxl/mbox: Break poison list loop on an empty payload cxl/pci: Honor -EPROBE_DEFER from component register setup cxl/port: Restart port enumeration when a sibling adds the dport first hfsplus: validate thread record before delete key rebuild wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate x86/entry/fred: Encode frame pointer on entry firmware: arm_scmi: Publish channel state before callbacks firmware: arm_scmi: Unregister device notifier before IDR teardown firmware: arm_scmi: Quiesce notifications before teardown firmware: arm_scmi: Clean up channels on setup failure firmware: arm_scmi: Free transport channel on IDR failure firmware: arm_scmi: Avoid IDR updates while cleaning channels firmware: arm_scmi: Reject out of range DT protocol IDs firmware: arm_scmi: Use channel ID for transport teardown firmware: arm_scmi: Protect device request lookup with RCU firmware: arm_scmi: Drop handle on protocol bind failures firmware: arm_scmi: Unwind TX receiver mailbox setup failure firmware: arm_scmi: Unwind P2A receiver mailbox setup failure firmware: arm_scmi: Fix transport device teardown lookup cxl/features: Reject Get Feature count larger than the output buffer cxl/features: Reject Set Features output buffer smaller than the header cxl/features: Clamp Get Feature output size to the remaining buffer regulator: adp5055: Fix error code in adp5055_of_parse_cb() tools/sched_ext: scx_qmap: Fix stale API name in comment libnvdimm/labels: Bound the on-media label size before the shift dax: read holder_ops once in dax_holder_notify_failure() cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() PCI: xgene: Drop unnecessary OF node reference irqchip/renesas-irqc: Fix generic interrupt chip leak on remove media: i2c: rdacm21: Fix missing media_entity_cleanup() media: bcm2835-unicam: Fix asc leaked in error/remove path media: ipu6: Do not free aux device pdata after init drm/amd/display: Fix DM I2C teardown race drm/amd/display: Remove unused-but-set variable hubp from cpufreq: intel_pstate: Fix setting minimum P-state at init time cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev perf: evsel: Fix error handling in tp_format lookup drm/bridge: tc358767: clamp the reported AUX read size to the request x86/mm/pat: Take cpa_lock around large-page collapse arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO arm64: dts: qcom: sc8280xp-x13s: Fix the drive-strength of mclk pin arm64: dts: qcom: ipq5018: Correct CMN PLL reference clock rate arm64: qcom: ipq5018: Add GEPHY RX and TX clocks arm64: dts: qcom: sm8250: sort out Iris power domains arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table perf jevents: Add more components to the metric sorting order clk: qcom: gcc-glymur: Enable runtime PM soc: renesas: r8a78000: Drop duplicate "default ARCH_RENESAS" spi: geni-qcom: Fix sticky ret causing wrong return value on invalid proto wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser wifi: iwlwifi: mei: check SAP message length before reading it wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments wifi: iwlwifi: mei: pass correct argument to function gpu: host1x: Fix offset calculation in trace_write_gather gpu: host1x: Avoid stack over-read in debug output helpers drm/msm/a6xx: Fix stale rpmh votes after suspend drm/msm: Recover HW before retire hung submit drm/msm/a6xx: Fix A663 GPUCC register list for state capture drm/msm/a6xx: Fix A621 GPUCC register list for state capture drm/msm: Fix task_struct reference leak in recover_worker drm/msm: Only fini scheduler after successful init crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping ACPI: processor: idle: Expand _LPI package sanity checks usb: gadget: f_uac1_legacy: remove broken string configfs attributes tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 UDF symlink pathComponent header OOB read staging: rtl8723bs: remove multiple blank lines in core/ staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths gpib: Move stuck SRQ update under lock uio: Fix stale info pointer in failed registration path accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() speakup: keyhelp: guard letter_offsets possible out-of-range indexing misc: bcm-vk: Use acquire/release for msgq_inited misc: rtsx: add missing write register handling misc: ad525x_dpot: use driver core groups for sysfs files misc: lan966x_pci: depopulate children on populate failure cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) ppdev: prevent overflow when setting port timeout ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove char: xilinx_hwicap: unregister class on init errors vfio/pci: clear vdev->msi_perm after freeing it on init failure mtd: intel-dg: Fix runtime PM error path in probe mtd: mtdswap: Avoid freeing registered blktrans device twice mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() perf ui hists: Fix uninitialized stack memory free on pstack allocation failure software node: Fix software_node_get_reference_args() with index -1 driver core: soc: Unregister bus on early device registration failure drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg bpf: Reject arena frees below the arena base dmaengine: dw-edma: Terminate all descriptors without callbacks dmaengine: dw-edma: Serialize abort state updates dmaengine: dw-edma: Serialize channel state checks dmaengine: dw-edma: Clear stale requests on termination ASoC: meson: Keep link pointers valid on realloc failure phy: starfive: Fix runtime PM cleanup in JH7110 DPHY TX probe phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe arm64: dts: amlogic: meson-axg: Add missing nand_rb0 pin to nand_all_pins arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe RDMA/hfi1: Propagate sdma_txinit_ahg() errors RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters kcsan: avoid unintended access checking in NMIs arm64: dts: imx8-ss-audio: Fix LPCG clock indices for ASRC0 x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist selftests/bpf: Check malloc result with ASSERT_NEQ in test_sha256 selftests/bpf: Silence array bounds warning in global_map_resize irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() RDMA/nldev: validate dynamic counter attribute length ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer ACPI: processor: validate MADT IOAPIC entry bounds ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root ext4: fix circular lock dependency in ext4_ext_migrate ext4: fix out-of-bounds read in ext4_read_inline_dir() ext4: skip extra isize expansion during mount to prevent deadlock platform/x86: acer-wmi: reject missing gaming WMI results bpf: Zero queue and stack outputs on lock failure libbpf: Search /lib64 and /lib in resolve_full_path() riscv, bpf: Fix memory leak in bpf_jit_free riscv, bpf: Fix kernel stack corruption in tailcall with CFI bpf, riscv: Fix extable handling for arena load_acquire ACPI: battery: Adjust charging status validation check virt: arm-cca-guest: use migrate_disable() for attestation token requests bpf: Fix offset warn check for bpf_res_spin_lock bpf: Preserve unique-field state across nested structs bpf: Mark bpf_refcount field as unique RDMA/srpt: Pass the mapped task attribute to target_init_cmd() PCI: j721e: Fix incorrect max_lanes for J7200 RDMA/erdma: Fix CEQ tasklet use-after-free on removal RDMA/mana_ib: drain QP references after partial table insertion RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations RDMA/core: Fix use after free in ib_query_qp() RDMA/core: Fix potential use after free in ib_destroy_cq_user() RDMA/core: Fix potential use after free in ib_destroy_srq_user() RDMA/core: Fix potential use after free in counter_release() RDMA/core: Fix potential use after free in ib_free_cq() RDMA/core: Fix potential use after free in uverbs_free_dmah() RDMA/core: Fix potential use after free in ib_dealloc_pd_user() firmware: arm_scmi: Fix requested device removal race iommu/amd: Fix undefined behavior in devid_write debugfs function iommu/qcom: Remove sysfs device on probe failure path iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() iommu/arm-smmu-v3: Declare eats_s1chk and eats_trans as host-endian u64 thermal: intel: int3400: clean up ODVP on probe failures ext4: clear stale xarray tags on folios skipped during writeback ext4: drain in-flight DIO before buffered write fallback ext4: use fsdata to track inline data write state and fix race ext4: validate readdir offset before accessing dirent wifi: ath6kl: avoid buffer overreads in WMI event handlers wifi: ath12k: switch to name-based reserved memory lookup wifi: ath12k: refactor QMI memory assignment wifi: ath12k: allocate HOST_DDR and BDF regions after Q6 RO region wifi: ath12k: Correctly copy the hint BSSID in WMI scan request wifi: ath11k: Correctly copy the hint BSSID in WMI scan request wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap ext4: fix buffer_head leak in ext4_init_orphan_info ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() ARM: dts: allwinner: a10: Fix PMU interrupt cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active amd-pstate: Make certain freq_attrs conditionally visible cpufreq/amd-pstate: Add dynamic energy performance preference cpufreq/amd-pstate: Add support for platform profile class cpufreq/amd-pstate: Fix EPP return type and handle errors during initialization cpufreq/amd-pstate: Toggle auto_sel in active mode on shared memory systems firmware: arm_scmi: Roll back partial protocol table registration firmware: arm_scmi: Unrequest devices if driver registration fails riscv: dts: spacemit: k1: Split gmac_clk_ref into independent pinctrl groups perf cs-etm: Flush thread stacks after decoder reset perf cs-etm: Avoid truncating AUX buffer sizes to int xfrm: Fix skb double-free in xfrm_dev_direct_output() RDMA/erdma: complete object teardown when the destroy command fails PM: hibernate: Fix memory leak in snapshot_write_next() error path leds: pca9532: Fix phantom device registration on missing hardware perf cap: Remove used_root parameter and simplify capability checks drm/tve200: add OF module alias for autoloading netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() arm64: dts: rockchip: Add missing hclk for RK3588 eDP0 arm64: dts: rockchip: Add missing hclk for RK3588 eDP1 arm64: dts: rockchip: Fix Gru WLAN sideband interrupt arm64: dts: rockchip: Fix rk3566-bigtreetech-cb2 touchscreen property bpf: Fix CFI mismatch in task work callback ARM: lpc32xx: only run SoC init on LPC32xx hardware selftests/bpf: Fix incorrect error checking for pthread_create selftests/bpf: Fix memory leak on subtest_states reallocation cxl/region: Fix use-after-free in find_pos_and_ways() error path pinctrl: mediatek: free EINT resources on unbind tools/build: Allow versioning of all LLVM tools defined in Makefile.include arm64: RSI: fix field-spanning write warning in attestation token init power: supply: sbs-battery: Use a per-device serial number buffer scsi: ufs: debugfs: Reserve space for a string terminator crypto: keembay - Initialize completion before requesting IRQ crypto: keembay - publish OF module alias for OCS AES/SM4 RDMA/mlx5: Fix integer overflow of user QP buffer size thermal/drivers/airoha: Fix copy paste error on clamp_t low temp thermal/drivers/airoha: Fix copy paste error for sen internal thermal/drivers/qcom-spmi-adc-tm5: Drop IIO_VAL_INT check in adc_tm5_get_temp powercap: intel_rapl_tpmi: Handle PMU registration failure during probe isofs: release zisofs block pointer buffer head clk: mediatek: mt6735: Unregister PLLs on probe failure spi: oc-tiny: switch to managed controller allocation w1: ds2482: Fix signedness bug in ds2482_w1_triplet() cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf remoteproc: Allow shutdown of crashed processors remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() remoteproc: Prevent crash handling to race with rproc_del() staging: rtl8723bs: use kfree_sensitive() for key material fs/ntfs3: reject restart table growth beyond U16_MAX entries iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path RDMA/rxe: Fix UAF in ODP init error-handling path RDMA/efa: Fix PBL chunk length computation wifi: mac80211: fix per-STA profile length in cross-link CSA parsing arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix clk: tegra: tegra124-emc: put EMC node on register failure clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path clk: palmas: Manage external-control prepare with devm clk/x86: pmc_atom: add kasprintf return value check clk: mediatek: mt8135: Fix inverted gate control for devapc_ck clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs nilfs2: fix infinite loop in nilfs_clean_segments() nilfs2: prevent out-of-bounds read in super root block parsing nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs RDMA/mlx5: Send cong param changes to the resolved port mdev RDMA/cxgb4: free STAG index when TPT entry write fails media: staging/ipu7: fix async notifier leak on init error IB/isert: reject PDUs declaring more data than was received IB/isert: reject login PDUs declaring more data than was received nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request spi: davinci: switch to managed controller allocation wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() wifi: ath12k: validate TLV length in process_tpc_stats() PCI: starfive: Fix Runtime PM handling and teardown ordering PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe drm/msm: remove objects from evit list after pinning them media: qcom: iris: Fix bitmask test in iris_allow_cmd() media: qcom: iris: handle runtime PM resume failure in core deinit platform/chrome: cros_ec_debugfs: Clean up console log on probe failure platform/chrome: cros_ec_debugfs: Unregister panic notifier wifi: rtlwifi: pci: fix error path in rtl_pci_probe() bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET bus: mhi: host: Fix controller cleanup on EDL sysfs failure md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency md/raid5-ppl: fix use-after-free in ppl_do_flush() md/raid5: protect lockless recovery_offset accesses during reshape fanotify: stop permission watchdog when timeout is zero tools/nolibc/powerpc: mark ctr and xer as clobbered by system call md: recheck spare changes before starting sync selftests/zram: fix kernel_gte() for POSIX sh Revert "serial: 8250: Clear CON_PRINTBUFFER on port re-registration" wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() md/raid10: consistently fail atomic writes that require splitting rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep arm64: dts: qcom: msm8976-longcheer-l9360: Fix accidental node override arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property arm64: dts: qcom: qcs404: Fix DTBS Check errors in usb controller nodes clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en firmware: qcom: scm: add trace events for the SMC call interface firmware: qcom: scm: instrument SMC call path with tracepoints firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published firmware: qcom: scm: Fix reserved memory cleanup on probe failure firmware: qcom: scm: Fix tzmem state on probe retry block: don't set BIO_QUIET for BLK_STS_AGAIN block: add a bio_endio_status helper block: fix dio leak on metadata mapping error arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID power: supply: isp1704_charger: cancel work on remove power: supply: sc2731_charger: cancel work on remove bpf: Fix potential UAF in bpf_netns_link_update_prog bpf: Fix potential UAF when reading bpf link info lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone clk: qcom: gpucc-qcm2290: Park RCG's clk source at XO during disable clk: qcom: Return expected ENOMEM error on dynamic allocation failure md/bitmap: resume array on backlog_store() error path md: remove unused mddev argument from export_rdev md: skip redundant raid_disks update when value is unchanged md: scope memalloc_noio to allocation critical sections iommu/dma: Check atomic pool allocation result directly swiotlb: Preserve allocation virtual address for dynamic pools i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices i3c: master: adi: add OF module alias for autoloading fs: annotate inode timestamp accessors md/raid1: create serial pool adding rdev to array with serialize_policy=1 locking/lockdep: Fix NULL pointer dereference in __lock_set_class() powerpc: implement get_direction() in cpm2 powerpc/44x: Set GPIO chip parent powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr() misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() misc: sgi-gru: remove interrupt-context page-table walks fanotify: report full event length for FIONREAD wifi: mt76: connac: add MT7991A (0x7991) to is_mt7996() wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 wifi: mt76: always enable RRO queues for non-MT7992 chipset wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash wifi: mt76: mt7925: update clc before setting sar power table wifi: mt76: mt7925: fix msg len mismatch between driver and firmware wifi: mt76: mt792x: Fix memory leak in SDIO TX path wifi: mt76: mt7996: fix EAPOL source BSS for non-MLD stations wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU wifi: mt76: fix RX data queuing of RRO 3.0 wifi: mt76: mt7996: set specific BSSINFO and STAREC commands after channel switch wifi: mt76: mt7996: fix out-of-bounds array access during hardware restart wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP wifi: mt76: fix non-AQL packet accounting for MLO stations wifi: mt76: assign link_id when sending probe request during scan wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss wifi: mt76: mt7996: don't report a zero TX bitrate wifi: mt76: mt7915: write RX header translation bit to the correct register wifi: mt76: fix stranded frames in mt76_txq_schedule_pending wifi: mt76: fix uninitialised RXDMAD_C descriptor info wifi: mt76: fix RXDMAD_C buffer recycling race wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie wifi: mt76: check txfree done event on the WED hw path wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config wifi: mt76: mt7915: unwind state on add_interface failure wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV wifi: mt76: mt7996: don't leak MLD group index on remap alloc failure wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields wifi: mt76: mt7996: add missing rdd_idx check when enabling background radar wifi: mt76: only consume the WO drop bit on WED v2 devices ACPI: processor: Unregister cpufreq notifier on init failure drm/msm: don't tear down KMS twice when KMS init fails drm/msm/dp: reject YUV420-only modes without VSC SDP support drm/msm/dp: do not reject wide-bus modes while a YUV420 mode is active perf: arm_spe: Make wakeup range check overflow safe drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) drm/msm/dp: Drop dev_pm_opp_set_rate(0) drm/msm/dsi: Drop dev_pm_opp_set_rate(0) wifi: ath11k: fix leak in ath11k_service_ready_ext_event() soundwire: Add a helper function to wait for device initialisation ASoC: tas2783: Use new SoundWire enumeration helper ASoC: codecs: tas2783-sdw: Propagate regcache_sync() errors ASoC: tas2783-sdw: drop stale regcache on uninitialized re-attach regulator: core: use system_freezable_wq for init complete work perf machine: Fix fd leak on bounds check in maps__set_modules_path_dir() perf machine: Fix NULL parent dereference in fork event processing perf machine: Guard against NULL strlist in machines__findnew() perf machine: Check snprintf truncation in machines__findnew() perf machine: Don't abort guest map creation on first inaccessible dir perf machine: Reset errno before strtol in guest kernel map creation perf machine: Free scandir entries in guest kernel map creation perf machine: Check snprintf truncation for guest kallsyms path bpf, x86: Fix trampoline stack size for 128-bit arguments wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement wifi: mt76: mt7996: skip key upload when adding an offchannel link wifi: mt76: mt7996: wake MCU waiters before aborting scan in L1 SER wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset wifi: mt76: mt7996: fix MIB TX aggregation counter registers for mt7990 wifi: mt76: mt7915: fix double hif2 init on the non-WED path wifi: mt76: mt7915: fix ext PHY use-after-free on register error path wifi: mt76: mt7915: release hif2 reference on probe IRQ failure wifi: mt76: mt7996: fix reg addr remap when addr is 0 wifi: mt76: mt7996: do not attach hif2 WED when the main WED attach failed wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 wifi: mt76: mt7915: report RX chain signal for all RX paths wifi: mt76: fix queue assignment for disassoc packets wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum wifi: mt76: reject out-of-range link ids in mt76_vif_link() wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx() wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump wifi: mt76: mt7996: remove beacon_int_min_gcd from ADHOC interface combinations arm64: smp: Fix IPI teardown for GICv5 flow arm64/fpsimd: ptrace: Fix inactive SVE and SSVE regsets kselftest/arm64: fp-ptrace: Fix checks for inactive SVE and SSVE regsets kselftest/arm64: Don't write to P0 in irritator on SME only systems iommu/arm-smmu-v3: Convert to use atomic poll timeout perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register wifi: mac80211: send TWT teardown to peer after setup TX failure wifi: zd1211rw: reject secondary interfaces to prevent conflicts wifi: mac80211: skip unused probe response countdown offsets wifi: mac80211: disconnect on CSA to channel 0 wifi: nl80211: refactor nl80211_parse_chandef wifi: cfg80211: Add an API to configure local NAN schedule wifi: cfg80211: stop PMSR before P2P and NAN teardown firmware: google: Add bounds checks in coreboot_table_populate() firmware: coreboot: Validate table bounds pinctrl: eswin: Fix Handling of PIN_CONFIG_PERSIST_STATE pinctrl: spacemit: validate pins in pinconf callbacks powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass powerpc/irq: Fix missing r2 clobber in PCREL inline assembly soc: fsl: qe: properly scan GPIO nodes at startup soc: fsl: qe: implement get_direction() MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL serial: amba-pl011: unprepare console clock on unregister serial: amba-pl011: keep console clock enabled for atomic writes tty: clear cdev pointer after cdev_add() failure dm-integrity: replace forgeable discard filler with a keyed sector marker misc: pci_endpoint_test: Check SUCCESS bit for doorbell status HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver HID: synchronize input before cleaning up a failed probe HID: i2c-hid: Fix "(null)" output when reading report descriptor fails HID: steam: Refactor and clean up report parsing HID: steam: Rename some constants that got renamed upstream HID: steam: Add support for sensor events on the Steam Controller (2015) HID: steam: Improve logging and other cleanup HID: steam: Reject short reads HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure HID: lg4ff: validate report length before fixed offsets perf thread-stack: Fix heap buffer overflow on branch stack wrap copy perf auxtrace: Fix queue grow overflow and old array leak perf intel-pt: Fix off-by-one in auxtrace_info minimum size check perf intel-bts: Fix off-by-one in auxtrace_info minimum size check perf arm-spe: Reject zero nr_cpu in metadata to prevent division by zero iio: light: tsl2772: fix ALS calibscale readback iio: light: isl29028: return zero in write_raw() on success iio: light: tsl2583: return zero in write_raw() on success net: stmmac: Skip PHY attach if custom PCS is in use phonet: pep: do not write beyond optlen in getsockopt blk-cgroup: fix race between policy activation and blkg destruction blk-cgroup: skip dying blkg in blkcg_activate_policy() block/blk-stat: drain per-cpu callback stats over possible CPUs block/blk-iocost: collect per-cpu latency stats over possible CPUs block/kyber-iosched: flush per-cpu latency buckets over possible CPUs ublk: check import_ubuf() return value ublk: check for ublk_unmap_io() returning 0 ocfs2/cluster: keep heartbeat local node stable lib/string: fix memchr_inv() for large ranges pps: don't try to wait for negative timeouts in PPS_FETCH pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler pps-gpio: remove dead capture_clear code rapidio: clear mport->net when rio_add_net() fails fat: release buffer head after rebuilding parent riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller drm/omap: dsi: Do not copy isr table arm64: dts: qcom: agatti: Add missing CX power domain to DISPCC remoteproc: Move resource table data structure to its own header remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed selftests/mm: ksm_tests: use kselftest framework selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes selftests/mm: fix ternary operator precedence in ksm_tests arm64: dts: qcom: sc8280xp-blackrock: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: qcs8550-aim300: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sar2130p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies bpf: Check load-acquire src ptr type before the load intel_idle: Avoid using deep idle states during initialization scripts/tags.sh: Prevent binary files appearing in cscope.files modpost: prevent leak when early return no suffix .o in read_symbols() kbuild: fix modules.builtin(.modinfo) targets in the top-level Makefile RDMA/erdma: Hold CQ references when processing EQ events RDMA/erdma: Hold QP references for AE and CM processing RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ ARM: 9481/2: breakpoint: CFI breakpoints only on demand ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults perf libbfd: Validate BPF prog info arrays before pointer cast perf bpf: Add PROG_TAGS to required arrays in __bpf_event__print_bpf_prog_info() perf libbfd: Fix memory leaks and NULL fclose in BPF disassembly ocfs2: synchronize heartbeat callbacks with o2net teardown clk: rockchip: rk3576: fix source muxes for SPI0..SPI4 drm/sun4i: vi scaler: Fix coefficient selection drm/sun4i: tcon: Set output mux for DSI and LVDS drm/sun4i: tcon: Drop TCON TOP device reference drm/sun4i: hdmi: Don't leak sync polarity bits into packet control drm/sun4i: crtc: Propagate layer initialization error drm/sun4i: tcon: Drop remote endpoint reference drm/sun4i: dw-hdmi: Drop TCON TOP port reference drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz rust: cpufreq: Add CPUFREQ_TABLE_END as last table entry in TableBuilder::to_table rust: cpufreq: Fix temporary write in Registration::bios_limit_callback cpufreq: imx6q: fix devres accumulation across driver rebind cpufreq: imx6q: fix out-of-bounds write when probed more than once IB/isert: delay the final Login Response until the session is registered IB/isert: post the full-feature receive buffers after session registration RDMA/siw: Fix use-after-free in siw_accept() module: use strscpy() to copy module names in stats and dup tracking module/dups: Inform duplicate requests about the result directly module/dups: Fix use-after-free in kmod_dup_req lifetime handling RDMA/erdma: restrict the driver to little-endian systems UBUNTU: [Config] Disable CONFIG_INFINIBAND_ERDMA on s390x wifi: mac80211: skip default WMM setup for AP_VLAN links arm64: hibernate: mask DAIF before restoring hibernated kernel arm64: hibernate: Restore DAIF state on error mfd: rave-sp: validate received frame payload lengths mfd: iqs62x: Reject zero-length firmware records mfd: macsmc: Fix key count endianness annotation leds: gpio: Clear error pointers for skipped LEDs drm/amdgpu/gfx6: Fixup emit_cntxcntl() ext4: fix spurious message about orphan cleanup on RO fs arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator phy: sunplus: fix error handling in sp_uphy_init() phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table perf trace-event: Fix buffer overflow in read_string() drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets drm/amdgpu/gfx6: Use PFP on the compute queues too scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path firmware_loader: do not queue completed sysfs fallback requests pinctrl: rockchip: Reset the pin count when recalculating SoC data hugetlbfs: release subpool on fill_super failure soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*() phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend phy: qcom: qmp-pcie: Add pcs_lane1 offset to V5 offsets md/raid5: round bitmap stripes with sector division md: wait for behind writes before destroying bitmap md: avoid stale clone I/O accounting timestamps md/md-llbitmap: prevent create failure bitmap UAF md/md-llbitmap: stop daemon timer rearm on destroy md/raid1: don't set array_frozen in raid1_takeover() coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() coresight: etm4x: fix underflow for usage of (nrseqstate - 1) coresight: etm4x: fix leaked trace id perf: arm_pmuv3: Zero initialize hw_id branch stack field bpf: Reject load-acquire from pointers requiring fault protection bpf, riscv: Add and use bpf_atomic_is_load_acq() helper bpf, x86: Fix exception table metadata for arena load-acquire bpf, arm64: Fix exception table metadata for arena load-acquire regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling ACPI: video: Release PCI device reference after lookup perf/x86/intel/pt: Factor out pt_config_enable() perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED perf/x86/intel/pt: Fix stop/start with no update sched/fair: Also gate overloaded status update for SD_ASYM_CPUCAPACITY sched/fair: Check CPU capacity before comparing group types during load balance Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() Bluetooth: btusb: refactor endpoint lookup Bluetooth: btusb: Record matched usb_device_id into btusb_data Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices perf trace-event: Fix integer truncation in do_read() and skip() scsi: sd: Fix sd_done() sense handling condition btrfs: defrag: fix deadlock between defrag and delalloc space reservation btrfs: always wait for ordered extents to avoid OE races btrfs: retry verity reads for not-uptodate Merkle folios btrfs: zoned: don't clobber the extent buffer when zeroing it out btrfs: use aligned range for locking in extent_fiemap() btrfs: avoid GFP_ATOMIC allocations in qgroup free paths btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() pinctrl: airoha: fix mdio bitfield names pinctrl: airoha: an7581: fix pinconf of i2c_scl/i2c_sda pins pinctrl: airoha: an7583: fix I2C0_SDA_PD register bit order pinctrl: airoha: an7581: fix mux/conf of pcie_reset pins pinctrl: airoha: an7583: fix muxing of non-gpio default pins pinctrl: airoha: an7583: fix spi group pins pinctrl: airoha: add missed get_direction() function for gpio_chip pinctrl: airoha: fix getting gpiochip/pinctrl pointers in the IRQ handling code pinctrl: airoha: add missed IRQ resource helpers pinctrl: airoha: fix IRQ mask/unmask code pinctrl: airoha: fix edge-triggered interrupts handling Bluetooth: virtio_bt: avoid OOB read of build info string Bluetooth: btintel: Fix diagnostics event detection Bluetooth: hci_conn: fix the SCO setup context lifetime Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths Bluetooth: MGMT: free the mesh send cancel command when it is cancelled Bluetooth: MGMT: free the HCI command when it is cancelled mmc: sdio: add MediaTek MT7902 SDIO device ID Bluetooth: btmtk: add MT7902 MCU support Bluetooth: btmtk: add MT7902 SDIO support Bluetooth: btmtksdio: fix usage_count leak when autosuspend_delay is negative Bluetooth: MSFT: validate evt_prefix_len against the response length bpf, cgroup: Fix storage null-ptr-deref after replacing prog iio: light: opt4060: Fix pointer type passed to div_u64_rem() iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes iio: light: gp2ap002: re-enable irq if runtime suspend fails net/sched: cls_api: fix teardown of an adopted proto on insert-race loss riscv: cpufeature: Clarify ISA spec version for canonical order bpf: Factor out stack_map build ID helpers bpf: Avoid faultable build ID reads under mm locks bpf: Fix mmap_lock leak in irq_work path i3c: renesas: Return immediately if there is no transfer i3c: renesas: Follow a unified pattern for transfer and command initialization i3c: renesas: Don't register devices when ENTDAA times out arm64: dts: turris-mox: fix usb3 phys ARM: dts: helios4: add vcc-supply to EEPROM ARM: dts: helios4: add vcc-supply to GPIO expander ARM: dts: helios4: add SATA regulator supplies perf stat: Fix evsel_list leak in cmd_stat perf synthetic-events: Fix uninitialized pthread_join perf test: Support dynamic test suites with setup callback and private data perf test: Fix skiplist leak in cmd_test perf python: Check counts_values size in set_values perf python: Handle Py_None for thread and cpu maps perf python: Validate CPU and thread maps in pyrf_evsel__open perf python: Fix memory leak in pyrf__metrics_cb perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() fbdev: kyro: Validate overlay viewport coordinates fbdev: clps711x-fb: Remove unreachable unregister_framebuffer() call iommu/dma: Restore locking around msi_page_list iommu/vt-d: Fix UCTP context table slot when copying root entries iommu/vt-d: Clear Present bit before tearing down copied context entry iommu/vt-d: Tear down scalable-mode context on probe failure iommu/vt-d: Flush context cache with correct SID when tearing down aliases crypto: qat - use 2-arg strscpy where destination size is known crypto: qat - remove dead ADF_HEX code hwrng: imx-rngc - Disable clock on registration failure m68k: Fix backtraces for non-running tasks xdrgen: Do not declare union XDR functions in the definitions header xdrgen: Fix opaque and string encoders for unbounded members arm64: Disable KCSAN instrumentation in delay.o hwmon: (cros_ec) Register the thermal devices after the hwmon ones hwmon: (cros_ec) Store the hwmon device in cros_ec_hwmon_priv hwmon: (cros_ec) Synchronize EC access from the thermal device callbacks SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE nvmet: fix Reservation Register Replace for unregistered host with IEKEY nvmet: propagate percpu_ref_init() failure in nvmet_ns_enable() nvme-pci: release descriptor pools on probe failure cgroup/cpuset: Use WRITE_ONCE() for shared prs_err updates selftests/sched_ext: Check skeleton open failure in exit test amt: Don't support cross-netns setup. powerpc/configs: enable CONFIG_RAS to fix EDAC support iommu/amd: Fix incorrect device ID in invalid PASID error message rust: uapi: replace direct asm-generic/ioctl.h include with linux/ioctl.h phy: renesas: rcar-gen3-usb2: Ignore missing VBUS regulator phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs phy: qcom: qmp-combo: Drop qmp_v4_calibrate_dp_phy spi: sprd-adi: Fix probe succeeding without registering the controller ASoC: qcom: q6apm: keep the graph start count in sync with the DSP arm64: bti: Disable in-kernel BTI with recent versions of Clang integrity: Make arch_ima_get_secureboot integrity-wide s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN nvme: Add the DHCHAP maximum HD IDs nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate() nvme-apple: Destroy the admin queue on removal nvme-apple: Don't set a DMA direction for commands without a data transfer nvme-apple: Never set the opcode in the NVMMU TCB nvme: Add a quirk for page aligned admin queue buffers nvme-apple: Require page aligned buffers on the admin queue nvme-apple: Drop the PRP null check chicken bit nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() nvme: reject passthrough of driver-managed Set Features nfc: llcp: avoid userspace overflow on invalid optlen nfc: llcp: read llcp_sock->local under the socket lock in getsockopt nfc: nci: fix double completion race in nci_data_exchange_complete nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfc: pn533: hold a reference to the request skb during send_frame nfc: digital: Do not dump a NULL response in command completion nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing ALSA: seq: Don't leak the extension cell pointer in the bounce payload dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal RDMA/cxgb4: Free debugfs on registration failure RDMA/cma: Fix WARNING in res_to_rt ice: fall back to SBQ when LL PHY timer interface times out ice: clear the default forwarding VSI rule when releasing a VSI ice: acquire NVM lock around each flash read idpf: add missing cpu_to_le32 in idpf_tx_splitq_build_flow_desc ASoC: pxa: Use devm_clk_get_optional() for extclk clock ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready UBI: Preserve torture flag when rescheduling failed erasures UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs ubi: Fix rollback for explicit UBI device numbers mtd: ubi: Release device reference on busy detach ASoC: xilinx: formatter_pcm: fix stream_data leak on open error UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC firewire: core: add KUnit test skeleton for node tree firewire: core: add KUnit tests for successful tree building firewire: core: add KUnit tests for failure of tree building firewire: core: consolidate port counting in build_tree() firewire: core: validate parent port count before allocating nodes in build_tree() firewire: core: fix memory leak in error path of build_tree() PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore super: fix dying superblock warning messages perf build: Remove leftover feature tests for removed cxx and clang support kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix selftests: harness: Restore order of test functions selftests: harness: Mark test fixture objects __maybe_unused selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM spi: img-spfi: don't disable runtime PM on DMA deferred probe PCI/ASPM: Disable/restore ASPM on every function for multi-function devices power: supply: bd99954: Drop bad register fields power: supply: bq27xxx: bq27520g4: fix REG_TTES address power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address xenbus: Unregister reboot notifier on init failure s390/debug: Fix deadlock during unregister clocksource/drivers/clps711x: Do not unmap clocksource MMIO clocksource/drivers/armada: Unwind timer clock on init failure ALSA: seq: midi: Optimize event_input locking with RCU ALSA: seq: midi: Serialize input teardown with event_input selftests/cgroup: Preserve CPU hotplug write errors x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported bpftool: Fix double close in map dump ocfs2: validate orphan slot during inode read ocfs2: validate DIO orphan slot during inode read ocfs2: fix circular locking dependency in ocfs2_init_acl() Squashfs: check block offset is not negative selftests/bpf: Fix for veristat file/prog filters processing scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers scsi: ufs: core: Set task state before io_schedule_timeout() net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race bpf, arm64: Fix stack-passed arguments for indirect trampolines fs/ntfs3: fix integer overflow in MFT cluster validation fs/ntfs3: reject out-of-range evcn in mi_enum_attr() ALSA: core: Fix use-after-free in snd_card_do_free() HID: haptic: don't write an uninitialized value to unhandled usages tracing: Have trace_event_update_all() only handle module that is loading ASoC: SOF: validate topology volume range before allocation HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU selftests/bpf: Add tests to verify the fix of encapsulating VxLAN in lwt selftests/bpf: Use ping_command() for IPv6 pings in lwt_ip_encap riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args ring-buffer: Remove trace_buffer::cpus ACPI: scan: fix bus ID cleanup on device_add() failures bpf: Fix pending_pos walk on 32-bit ring position wrap selftests/sched_ext: Fix flaky ddsp failure tests on busy systems crypto: hisilicon/sec2 - fix CCM algorithm long packet failure crypto: lskcipher - propagate errors from unaligned crypt sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry perf dso: Guard against errno==0 when dso__get_filename() returns NULL perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() perf dso: Use stored fd error instead of stale errno in file_read() and file_size() perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() perf dso: Replace assert with runtime check in dso__read_symbol() mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler mailbox: qcom-cpucp: handle NULL data in send_data callback mailbox: rockchip: disable pclk on probe failure and unbind mailbox: pcc: Fix command timeout due to missed interrupt mailbox: riscv-sbi-mpxy: validate RPMI notification lengths null_blk: use DEFINE_MUTEX for the file-scope mutex null_blk: register configfs subsystem after creating default devices null_blk: free global tag_set on init error path null_blk: free zones array on device power-off null_blk: reject per-device queue resize for shared tag set null_blk: serialize configfs attribute stores with the lock null_blk: serialize configfs attribute updates with device setup ublk: reject non-power-of-2 zone sizes in SET_PARAMS block: mtip32xx: synchronize ioctls with device removal apparmor: fix deadlock in complain-mode change_hat hwmon: (coretemp) Fix core_data leak on CPUs without PTS hwmon: (emc1403) Drop hysteresis for low limit temperature ksmbd: Do not skip lock checks for single-byte ranges smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer ksmbd: validate ipc response length before dereferencing its fields ksmbd: do not advertise unimplemented CA support ksmbd: free preauth sessions on connection teardown smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request() smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger() smb/server: preserve error status in smb2_handle_negotiate() erofs: clean up encoded map flags erofs: error out obviously illegal extents in advance erofs: fix interlaced ztailpacking pclusters erofs: guard on-disk algorithm IDs against Z_EROFS_COMPRESSION_MAX lwt_bpf: Restore reserved headroom after xmit program erofs: fix unused pcluster_pools for higher page sizes bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks m68k: nfcon: Do not call console_is_registered() in nfcon_device() bpf: Reject negative optlen in cgroup getsockopt hook ksmbd: disconnect on SMB3 decryption failure ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size smb/server: fix session leak in ksmbd_session_register() nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper nfs: refactor pNFS functions using clear_and_wake_up_bit NFSv4: remove callback IDR entry on client allocation failure pnfs/blocklayout: Fix device leaks on parse failure NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() nfs: fix ENXIO on O_CREAT open of existing symlink over NFSv3 clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate() clk: ti: mux: resolve parent clocks by DT index, not by name bpf, xdp: move offload check into dev_xdp_install() octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap() hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed drm/xe: tests: fix error message in xe_migrate_sanity_test() ptp: netc: skip PEROUT disable if channel is not enabled ionic: fix completion descriptor access with 2x desc size net: kcm: Hold RCU read lock while running BPF parser net: dsa: b53: fix error propagation from b53_fdb_dump() pppox: drain queued packets on channel handoff net: hsr: free learned nodes on device setup failure f2fs:Fix incomplete search range in f2fs_get_victim when f2fs_need_rand_seg is enabled f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk} f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode ipvs: fix integer overflow in ftp helper port/address parsing vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error tls: fix RX desync on overlapping skbs net: bridge: vlan: fix inverted default vlan notification cuse: wait for pending RCU callbacks on module exit fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() fs/ntfs3: validate ef->size covers the record's name and value soc: qcom: ubwc: Fix missing include fuse: check for NULL root inode in fuse_fill_super_submount ALSA: hda: Fix connection list comparison in proc output vxlan: mdb: Fix use-after-free in vxlan_mdb_flush() 8139cp: fix Rx and Tx not being disabled in cp_suspend net/smc: hash socket only after full initialisation in smc_sk_init() platform/x86: dell-wmi-sysman: Fix instance ID bounds vsock: avoid timeout for non-blocking accept() with empty backlog vsock: don't check the listener's sk_err in vsock_accept() vsock: use sock_error() to consume sk_err after a failed connect platform/x86: hp-bioscfg: fix password encoding bounds check platform/x86/amd/hsmp: Reject negative power cap writes in hwmon mlxbf-bootctl: fix the build error with FIELD_PREP() bonding: initialize err for empty target lists net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() virtio_balloon: disable indirect descriptors vdpa_sim: fix cleanup after worker creation failure virtio: add virtio_device_shutdown() helper virtio_balloon: factor out virtballoon_quiesce() virtio_balloon: quiesce balloon work before device shutdown vhost/net: fix clear_user start address in VHOST_GET_FEATURES_ARRAY virtio_pci: fix wrong queue index for admin vq in intx path vdpa/mlx5: fix wrong list iterated in add_direct_chain error path virtio: rtc: time out alarm requests rtc: pcf8563: fix clock provider leak on unbind rtc: spacemit: handle regmap_test_bits() error return smb: client: fix request buffer leak in smb2_new_read_req() cifs: remove dead size-update blocks in cifs_setattr_unix/nounix rtc: zynqmp: Return optional clock lookup errors irqchip/renesas-rzg2l: Fix loss of interrupt i2c: ocores: Disable clock on failed resume rtc: gamecube: check return value of devm_rtc_register_device() lib/interval_tree: fix allocation warning messages prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator clk: ti: Make sure clk_init_data is fully initialized clk: visconti: Make sure clk_init_data is fully initialized irqchip/gic-v5: Synchronize CPU interface disable irqchip/gic-v5: Check for NULL LPI domain on domain teardown irqchip/gic-v5: Fix gicv5_init_common() error paths irqchip/gic-v5: Use logical cpu 0 irs_data for dynamic IST allocation ALSA: core: Add scoped cleanup helper for card references ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup RDMA/ucma: Allow path records to exactly fit the output buffer spi: amlogic-spisg: Make sure clk_init_data is fully initialized ALSA: mtpav: shut down output timer before card teardown smb: server: Remove obsolete "select CRYPTO_LIB_DES" from Kconfig file smb: server: remove unused DES crypto header irqchip/irq-realtek-rtl: Add/simplify register helpers irqchip/irq-realtek-rtl: Add multicore support irqchip/irq-realtek-rtl: Split out parent setup code irqchip/irq-realtek-rtl: Add interrupt data structure irqchip/irq-realtek-rtl: Add mask for interrupt handling irqchip/irq-realtek-rtl: Use readl_be()/writel_be() instead of readl()/writel() xsk: avoid double checking against rx queue being full xsk: fix NULL pointer dereference in __xsk_rcv() net: bridge: Reject descending VLAN tunnel ranges net/sched: add get_fill_size callbacks for actions missing them net: thunderbolt: Count delivered packets in rx_packets and rx_bytes net/mlx5: E-Switch, use state lock for vport state changes net/mlx5: Move vport DOWN state check out of mlx5_query_vport_max_tx_speed() net/mlx5: E-Switch, preserve max tx speed on vport state modification forcedeth: stop the tx_timeout register dump past the requested window net: ipa: balance runtime PM reference on remove error netdevsim: update queue NAPI association on queue reset ipv6: avoid divide by zero in rt6_multipath_rebalance net: add missing ref_tracker_dir_exit() to net_passive_dec() net: qlcnic: validate unified ROM sections before loading ipmr: Move unregister_netdevice_many() out of mroute_clean_tables(). ipmr: Move unregister_netdevice_many() out of ipmr_free_table(). ipmr: Convert ipmr_net_exit_batch() to ->exit_rtnl(). ipmr: Remove RTNL in ipmr_rules_init() and ipmr_net_init(). net: change sock_queue_rcv_skb_reason() to return a drop_reason ipmr: Free mr_table after RCU grace period. ip6mr: plug drop_reason to ip6mr_cache_report() inetpeer: randomize RB-tree node comparison using SipHash net: tcp: block mixing readable and unreadable frags net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition net/smc: free pending qentry in smc_llc_flow_stop() before memset NFSv4.2: fix LAYOUTSTATS send buffer exhaustion NFSv4/pnfs: key the data server cache on the NFS version rtc: pcf85363: Add error checking to regmap calls in probe() bnxt_en: Fix call to hardware monitoring event handler bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check ptp: netc: fix period truncation and potential divide-by-zero in PEROUT net: wangxun: replace busy-wait reset flag with kernel mutex net: wangxun: schedule hardware stats update in watchdog net: wangxun: introduce WX_STATE_DOWN to serialize device shutdown state net: txgbe: fix MISC interrupt unmasking in non-MSI-X mode and device shutdown net: libwx: fix concurrent bitmap overwrite in PTP setup net: page_pool: Remove zone/policy GFP flags when allocating XArray entries net_sched: sch_fq: fix pacing delay underflow with pacing offload Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition scsi: qla2xxx: Fix an loop timeout test erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic arm64: ptdump: Make note_page_flush() range aware arm64: process: Fix context switching MTE store-only tag check Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support Bluetooth: btmtk: Do not report success when subsys reset fails Bluetooth: btmtk: Do not discard the subsystem reset timeout Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path Bluetooth: btnxpuart: Validate the FW dump header length Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop xsk: align TX metadata layout across ABIs xsk: honor XDP_TX_METADATA in zero-copy path gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free octeontx2-af: fix NULL deref in NIX TM tree debugfs read path octeontx2-vf: fix workqueue and netdev race in probe/remove net: qualcomm: rmnet: restore skb->dev on deaggregated frames octeontx2-af: Fix TL3/TL2 link config ENA clearing net: enetc: restore RX ring congestion mode after ring reconfiguration net/sched: add qstats_cpu_drop_inc() helper net/sched: act_ife: Only operate on Ethernet frames net/rds: use wq_has_sleeper() in rds_cong_map_updated() octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup cifs: fix clearing stats for fastest execution of each smb2 command selftests/mm: skip COW tmpfile cases when fallocate() is unsupported maple_tree: catch race in mas_alloc_cyclic() maple_tree: fix argument name in header selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC net/sched: act_skbmod: fix length calculations and avoid invalid header warnings net: core: check skb_frags_readable before uncloning in skb_copy_ubufs net: fix a resource leak in copy_net_ns() error handling path net/sched: fq: add overflow bounds to quantum and initial quantum net/sched: fq_codel: clamp default quantum and mtu net/sched: sch_codel: clamp default mtu to avoid disabling CoDel net/sched: fq_pie: clamp default quantum to avoid signed overflow net/sched: hhf: clamp quantum before hhf_change() to avoid overflow net/sched: sfq: clamp quantum to avoid signed overflow soft lockup net/sched: sch_teql: restore skb->dev on the slave failure path tpm: st33zp24: Return zero on status read failure tpm: st33zp24: Validate locality read result crypto: acomp - allocate async request context when cloning apparmor: policy_int make sure list heads are initialized before fail path ASoC: dapm: Fix off-by-one check on the second enum channel ceph: Fix ERR_PTR(0) in ceph_mkdir() ceph: revalidate ki_pos for O_APPEND writes after cap acquisition libceph: validate banner payload length samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify net: ethernet: sun4i-emac: Fix IRQ error handling net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs net: stmmac: selftests: Pass the IP proto mask in the TC selftest drm/xe/xe_gt_idle: Add CCS to the powergating info print virtio-net: Ensure that TCP packets don't overflow gso_segs netfilter: nf_tables: move hardware offload step after building the chain blob netfilter: xt_HL: add pr_fmt and checkentry validation netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() ALSA: control: Don't add invalid kcontrols to LED layer selftests/arm64: Print missing MTE TAP headers selftests/arm64: Treat KSM merge_across_nodes as optional selftests/arm64: Fix MTE prctl TAP plan net: airoha: npu: fix missing streaming DMA mask net: stmmac: selftests: Check multiple MMC counters net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering net: stmmac: dwmac4: Account for the primary MAC address for UC filtering net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering net: stmmac: selftests: Account for the UC filter list for filtering tests net: stmmac: restore NET_IP_ALIGN in the RX DMA offset net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() net: fec: only stop PTP if it was initialized usb: atm: usbatm: fix invalid ci_range initialization tcp: fix corruption of urgent data on multi-segment retransmit net/sched: sch_htb: limit htb_classify inner-class filter hops dm-integrity: fix buffer overflow with keyed discard mtd: rawnand: pl353: Fix debug prints platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL serial: 8250: Ignore flow control on suspend/resume with no_console_suspend usb: ucsi: huawei_gaokun: move typec_altmode off stack cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks cpufreq/amd-pstate: Reorder notifier unregistration and floor perf reset cpufreq/amd-pstate: Return -ENOMEM on failure to allocate profile_name cpufreq/amd-pstate: Grab "amd_pstate_driver_lock" when toggling dynamic_epp cpufreq/amd-pstate: Add POWER_SUPPLY select for dynamic EPP UBUNTU: [Config] Make ACPI_PLATFORM_PROFILE built-in for amd64. UBUNTU: [Config] Add disable for X86_AMD_PSTATE_DYNAMIC_EPP cpufreq/amd-pstate: Fix setting EPP in performance mode wifi: nl80211: fix UHR capability validation integrity: Eliminate weak definition of arch_get_secureboot() UBUNTU: [Config] Disable IMA_SECURE_AND_OR_TRUSTED boot for s390x UBUNTU: [Config] Enable new config HAVE_ARCH_GET_SECUREBOOT block: save page offset gaps in cloned bio erofs: relax sanity check for tail pclusters due to ztailpacking erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check() ipmr: Call ipmr_fib_lookup() under RCU. ipmr: Add __rcu to netns_ipv4.mrt. tcp: reject non zerocopy devmem tx Bluetooth: btmtk: hide unused btmtk_mt6639_devs[] array net/sched: fq: clamp quantum and initial_quantum in change path cpufreq/amd-pstate: Add support for raw EPP writes cpufreq/amd-pstate: Use "epp_default_dc" as default when dynamic_epp is disabled cpufreq/amd-pstate: Allow writes to dynamic_epp when state isn't modified ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init ACPI: processor: idle: Move max_cstate update out of the loop ACPI: processor: idle: Remove redundant static variable and rename cstate check function drm/panel-edp: Add CSW PNB601LS1-2 and LGD LP116WHA-SPB1 drm/gem: Consider GEM object reclaimable if shrinking fails bus: fsl-mc: wait for the MC firmware to complete its boot drm/xe/guc: Add support for NO_RESPONSE_BUSY in CTB drm: rz-du: Ensure correct suspend/resume ordering with VSP drm: renesas: rzg2l_mipi_dsi: Fix deassert/assert of CMN_RSTB signal drm/amd/display: Fix DPMS using partially updated pipe context drm/panel: jadard-jd9365da-h3: set prepare_prev_first drm/amd/pm: Check SMUv13.0.6/12 metrics integrity wifi: ath9k: Obtain system GPIOS from descriptors gfs2: fix quota init duplicate scan gpio: usbio: Add ACPI device-id for NVL platforms gfs2: move quota_init qc iterator increment drm/xe: Fix null pointer dereference in devcoredump cleanup driver core: Replace dev->can_match with dev_can_match() iio: adc: rtq6056: add i2c_device_id support pinctrl: renesas: rzg2l: Handle RZ/V2H(P) IOLH configuration in PM cache ALSA: usb-audio: Propagate write errors in generic mixer put callbacks pinctrl: renesas: rzg2l: Add SR register cache for PM suspend/resume ima: return error early if file xattr cannot be changed usb: gadget: udc: skip pullup() if already connected tee: optee: Allow MT_NORMAL_TAGGED shared memory tools/nolibc: avoid call to wcslen() in _start_c() inserted by clang PCI: Stop setting cached power state to 'unknown' on unbind wifi: cfg80211: reject duplicate wiphy cipher suite entries hfsplus: fix issue of direct writes beyond end-of-file wifi: nl80211: reject beacons with bad HE operation wifi: nl80211: check link is beaconing for color change wifi: mac80211: always allow transmitting null-data on TXQs wifi: mac80211: use chandef in ieee80211_get_sta_bw() clk: clk-axi-clkgen: Add support versal timings wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() wifi: rtw89: suspend DIG when remain-on-channel wifi: rtw89: disable HTC field in AP mode wifi: rtw89: disable CSI STBC for VHT 160MHz psp: validate IPv4 header fields in psp_dev_rcv() i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() firmware: stratix10-svc: change get provision data to async SMC call bridge: Do not suppress ARP probes and DAD NS unconditionally soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list soundwire: validate DT compatible before parsing it media: chips-media: wave5: Fix Reports from Kernel Lock Validator media: chips-media: wave5: Release m2m_ctx after Instance Removed from List dm-raid: only requeue bios when dm is suspending spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM media: rc: mceusb: Add support for 04eb:e033 net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG s390/cio: Purge based on the cdev's online status media: platform: cros-ec: Add Kulnex and Moxoe to the match table wifi: mac80211: avoid out-of-bounds access in monitor thunderbolt: Avoid reserved fields in path config space for USB4 routers thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() thunderbolt: Keep XDomain reference during the lifetime of a service thunderbolt: Keep the domain reference while processing hotplug thunderbolt: Set tb->root_switch to NULL when domain is stopped thunderbolt: Don't create multiple DMA tunnels on firmware connection manager drm/amd/display: Find link encoder for flexible DIG mapping cases drm/amdgpu: Prefer ROM BAR for default VGA device drm/panel: Enable GPIOLIB for panels which uses functions from it media: dm1105: fix missing error check for dma_alloc_coherent net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family PCI: switchtec: Add Gen6 Device IDs net: dsa: mv88e6xxx: define .pot_clear() for 6321 media: v4l2-common: Always register clock with device-specific name net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family media: em28xx-video: fix missing res_free() on init_usb_xfer failure wifi: mac80211: explicitly disable FTM responder on AP stop rtase: Fix flow control configuration crypto: ixp4xx - fix buffer chain unwind on allocation failure crypto: omap - add omap_des_unregister_algs helper clk: renesas: cpg-mssr: Add number of clock cells check drm/bridge: tc358768: Set pre_enable_prev_first for reverse order dlm: add usercopy whitelist to dlm_cb cache PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() media: qcom: camss: avoid format string warning net/mlx5: Relax capability check for eswitch query paths drm/panel-edp: Add AUO B140XTN07.5, AUO B140HAK03.5, AUO B116XTN02.3, AUO B140XTK02.4, AUO B140HAN07.7 drm/panel-edp: Add BOE NT140WHM-N4T, BOE NT140WHM-T05, BOE NV140FHM-N40 phy: qcom: m31-eusb2: Make USB repeater optional ASoC: ti: omap3pandora: update board check to use DT compatible watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 net/mlx5: HWS, Check if device is down while polling for completion net/mlx5: HWS, Handle destroying table that has a miss table platform/chrome: Resolve kb_wake_angle visibility race drm/panel/tdo-tl070wsh30: Use refcounted allocation in place of devm_kzalloc() mmc: core: Add validation for host-provided max_segs genirq/proc: Size interrupt directory names for 10-digit interrupt numbers serial: 8250_port: recognize UPIO_AU mmc: davinci: avoid NULL deref of host->data in IRQ handler platform/x86: sel3350-platform: Retain LED state on load and unload drm/amd/display: Fix CRC open failure during active rendering pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction pinctrl: mediatek: common-v1: bypass pinctrl GPIO layer in set GPIO direction drm/amd/ras: Fix CPER ring debugfs read overflow hfsplus: rework hfsplus_readdir() logic net: phy: motorcomm: use device properties for firmware tuning drm/gud: Add RCade Display Adapter VID/PID pair media: chips-media: wave5: Add range checks for dec_output_info media: video-i2c: use vb2_video_unregister_device on driver removal bus: mhi: host: pci_generic: Round up nr_irqs to power of two drm/panel-edp: Add AUO B133HAN06.6 and BOE NV133FHM-N4F V8.0 HID: multitouch: Fix Yoga Book 9 14IAH10 touchscreen misclassification wifi: rtw89: phy: check length before parsing PHY status IE net: dsa: realtek: rtl8365mb: add support for RTL8367SB integrity: Check for NULL returned by asymmetric_key_public_key drivers/of: validate live-tree string properties before string use drivers/of: validate status properties in reconfig state changes soundwire: intel: Move suspend tracking from trigger to pm suspend clk: samsung: exynos850: mark APM I3C clocks as critical scsi: pm8001: Reject firmware update in fatal error state scsi: pm8001: Reject non-fatal dump when controller is crashed crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y crypto: atmel-ecc - add support for atecc608b net: airoha: Reserve RX headroom to avoid skb reallocation clk: qcom: clk-rpmh: Make all VRMs optional media: imon: Add iMON VFD HID OEM v1.2 key mappings RDMA/mlx5: Use QP port when decoding responder CQEs coresight: perf: Retrieve path and source from event data coresight: Disable source helpers in coresight_disable_path() drm/mediatek: dsi: Add compatible for mt8167-dsi iomap: don't make REQ_POLLED imply REQ_NOWAIT mailbox: Make mbox_send_message() return error code when tx fails drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction PCI: Wait for device readiness after D3hot -> D0uninitialized transition drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id drm/amdkfd: Fix OOB memory exposure in get_wave_state() drm/amdkfd: Check bounds on allocate_doorbell ALSA: hda/ca0132: add QUIRK_GENERIC path for Gigabyte GA-Z170X-Gaming G1 ALSA: ice1724: Fix blocking open for independent surround PCMs ALSA: usx2y: Drain pending US-428 pipe-4 output commands drm/amdgpu: use atomic operation to achieve lockless serialization sched/fair: Reject misfit pulls onto busy SMT siblings on asym-capacity iommu: arm-smmu-qcom: Ensure smmu is powered up in set_ttbr0_cfg drm/imagination: Don't timeout job if its fence has been signaled 9p: invalidate readdir buffer on seek arm64: panic from init_IRQ if IRQ handler stacks cannot be allocated arm64/daifflags: Make local_daif_*() helpers __always_inline drm/imagination: Populate FW common context ID before passing to the FW 9p: use kvzalloc for readdir buffer drm/amd/ras: reset CPER ring on corrupt entry size drm/amdgpu: cap ATOM command table nesting depth drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw drm/amdgpu: add first record offset check drm/amdgpu: Bound GPIO I2C table entry count from VBIOS drm/amdgpu: avoid integer overflow in VA range check drm/amdgpu: check and drop invalid bad page records bridge: Add missing READ_ONCE() annotations around FDB destination port thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() thunderbolt: Improve multi-display DisplayPort tunnel allocation thunderbolt: Verify PCIe adapter in detect state before tunnel setup firmware: arm_scmi: Validate SENSOR_UPDATE payload size firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size thunderbolt: Increase timeout for Configuration Ready bit wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed thunderbolt: Verify Router Ready bit is set after router enumeration bitfield: wire __bf_shf to __builtin_ctzll nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl net: usb: qmi_wwan: add MeiG SRM813Q net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() net/sched: sch_drr: make cl->quantum lockless net/rds: Don't sleep inside rds_ib_conn_path_shutdown net/mlx5: Switch vport HCA cap helpers to kvzalloc spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs befs: handle set_blocksize failures ntfs3: handle set_blocksize failures affs: handle set_blocksize failures bfs: handle set_blocksize failures minix: handle set_blocksize failures qnx4: handle set_blocksize failures jfs: handle set_blocksize failures hpfs: handle set_blocksize failures omfs: handle set_blocksize failures isofs: handle set_blocksize failures HID: bpf: Add Huion Inspiroy Frego M button quirk drm/panel-edp: Add LG LP129WT232166 panel usbip: vhci_hcd: fix NULL deref in status_show_vhci usb: core: hcd: fix possible deadlock in rh control transfers usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue serial: 8250: fix possible ISR soft lockup usb: host: add ARCH_AIROHA in XHCI MTK dependency tty: serial: 8250: protect against NULL uart->port.dev in register driver core: Avoid warning when removing a device while its supplier is unbinding crypto: atmel-sha204a - remove sysfs group before hwrng char/nvram: Remove redundant nvram_mutex gpib: Suppress setting END on error from NI_USB dongle irqchip/gic-v5: Immediately exec priority drop following activate pwm: mediatek: set mt7628 pwm45_fixup flag to false rcu-tasks: Fix possible boot-time tests failed for the call_rcu_tasks() virt: acrn: Fix irqfd use-after-free during eventfd shutdown wifi: rtw89: pci: enable LTR based on pcie control register netlabel: fix IPv6 unlabeled address add error handling RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() ALSA: seq: Remove arbitrary prioq insertion limit rds: filter RDS_INFO_* getsockopt by caller's netns rds: annotate data-race around rs_seen_congestion s390/zcore: Removed unused variables clk: socfpga: agilex: implement l3_main_free_clk thermal/drivers/tegra/soctherma: Switch to devm cooling device registration wifi: iwlwifi: fix the access to CNVR TOP registers wifi: iwlwifi: mld: honor BSS_CHANGED_BEACON_ENABLED wifi: iwlwifi: pcie: fix ACPI DSM check wifi: iwlwifi: mld: call iwl_mld_free_ap_early_key() for AP only wifi: iwlwifi: Transition to basic uAPSD with MAC_PM_POWER_TABLE API VER_3 wifi: iwlwifi: pcie: add two LNL PCI IDs wifi: iwlwifi: mld: disallow puncturing in US/CA for WH wifi: iwlwifi: mld: purge async notifications upon nic error wifi: iwlwifi: mld: keep healthy link on EMLSR missed beacon exit powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked() genirq/manage: Make NMI cleanup RT safe drm/panel: simple: Add AM-1280800W8TZQW-T00H mips: cps: Assemble jr.hb with an R2 ISA level iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed ALSA: usb-audio: Add quirk for Novation Mininova net: hsr: require valid EOT supervision TLV ipv6: addrconf: fix temp address generation after prefix deprecation net: napi: Skip last poll when arming gro timer in busy poll net: thunderx: fix PTP device ref leak in nicvf_probe() ALSA: hda: cs35l41: imply SERIAL_MULTI_INSTANTIATE drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device drm/amd/pm/si: Fix updating clock limits from power states drm/amd/display: Initialize dsc_caps to 0 ACPICA: Fix condition check in acpi_ps_parse_loop() ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() ACPICA: add boundary checks in acpi_ps_get_next_field() ACPICA: validate byte_count in acpi_ps_get_next_package_length() ACPICA: Prevent adding invalid references ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() ACPICA: validate handler object type in two places ACPICA: Add package limit checks in parser functions ACPICA: Add validation for node in acpi_ns_build_normalized_path() ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() ACPICA: add boundary checks in two places hfs: rework hfsplus_readdir() logic net: sfp: add quirk for OEM 2.5G optical modules pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP host1x: bus: Fix missing ops null check in error teardown scripts: modpost: detect and report truncated buf_printf() output drm/nouveau/gsp: add SEC2 to GA100 chip table x86/topology: Add missing struct declaration and attribute dependency ASoC: Intel: catpt: Complete coredump handling drm/nouveau/bios: skip the IFR header if present libbpf: Add __NR_bpf definition for LoongArch soc/tegra: fuse: Register nvmem lookups at probe soundwire: dmi-quirks: Disable ghost Realtek devices gfs2: page poisoning fix soundwire: only handle alert events when the peripheral is attached mmc: davinci: fix mmc_add_host order in probe ARM: tegra: tf600t: Invert accelerometer calibration matrix mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC ARM: tegra: p880: Lower CPU thermal limit tracing: Disable KCOV instrumentation for trace_irqsoff.o mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC clk: samsung: exynos990: Fix PERIC0/1 USI clock types media: qcom: camss: vfe-340: Proper client handling iio: light: stk3310: Deal with the ps interrupt issue in PM perf/ftrace: Fix WARNING in __unregister_ftrace_function iio: accel: mma8452: switch to non-devm request_threaded_irq() libbpf: Also reset {insn,data}_cur on realloc failure spi: tegra210-quad: Allocate DMA memory for DMA engine net: ibm: emac: Reserve VLAN header in MJS limit wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi ASoC: codecs: pcm3168a: Prevent regulator double-disable in S4 ASoC: qcom: q6apm: return error code to consumers on failures ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive wifi: ath12k: Prevent incorrect vif chanctx switch when handling multi-radio contexts ata: ahci: fail probe if BAR too small for claimed ports ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach ppc/fadump: invoke kmsg_dump in fadump panic path net: qrtr: fix node refcount leak on ctrl packet alloc failure net: wwan: t7xx: Add delay between MD and SAP suspend net: txgbe: fix phylink leak on AML init failure iommu/rockchip: disable fetch dte time limit powerpc/fadump: Add timeout to RTAS busy-wait loops fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib nvme: refresh multipath head zoned limits from path limits fs/ntfs3: validate index entry key bounds ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() ASoC: codecs: rk3328: Use managed GPIO and clock helpers ALSA: seq: oss: Reject reads that cannot fit the next event dpaa2-switch: rework FDB management on the bridge leave path dpaa2-switch: fix the error path in dpaa2_switch_rx() net: dsa: sja1105: flower: reject cross-chip redirect dpaa2-switch: fix handling of NAPI on the remove path wifi: rtw89: 8851bu: add Mercusys MA60XNB (2c4e:0128) thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries nvme: validate FDP configuration descriptor sizes wifi: mac80211: clarify beacon parsing with MBSSID/EMA wifi: mac80211: unify link STA removal in vif link removal wifi: cfg80211: harden cfg80211_defragment_element() wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect wifi: iwlwifi: mvm: fix P2P-Device binding handling wifi: iwlwifi: add support for AX231 usb: xhci: Improve Soft Retries after short transfers usb: xhci: remove legacy 'num_trbs_free' tracking drm/amd/display: Avoid DPMS-on for phantom stream xhci: Prevent queuing new commands if xhci is inaccessible drm/amd/display: Check for sharpening case when calculating max vtaps for scaler drm/amdkfd: fix UAF race in destroy_queue_cpsch drm/amdgpu: harden FRU PIA parsing with bounded helpers drm/amd/pm: bound pp_dpm_set_pp_table() memcpy drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error drm/amdgpu: fix buffer overflow during vBIOS update drm/amdgpu: validate RAS EEPROM tbl_size before record count net/mlx5e: Verify unique vhca_id count instead of range RDMA/irdma: Fix typo in SQ completions generation drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq net/mlx5: E-Switch, align disable sequence with switchdev-to-legacy transition net: ibm: emac: fix unchecked platform_get_irq return value clk: keystone: don't cache clock rate ALSA: hda/realtek: ALC882: Fixup for Clevo P775TM1 ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP perf/x86/intel/uncore: Guard against invalid box control address ipmi: si: Use platform_get_irq_optional() to retrieve interrupt cxl/region: Validate partition index before array access x86/microcode/AMD: Move the no-revision fixup to get_patch_level() net: ethtool: cmis_cdb: hold instance lock for ops locked devices drm/amdkfd: fix SMI event cross-process information leak drm/amdkfd: Unwind debug trap enable on copy_to_user failure ipv6: use READ_ONCE() for bindv6only default in inet6_create() wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() RDMA/umem: Make ib_umem_is_contiguous() safe on 32 bit firmware: stratix10-svc: fix FCS SMC call kernel-doc RDMA/mlx5: Fix state and counter desync on loopback enable failure bpf: NUL-terminate replaced sysctl value net: cpsw_new: unregister devlink on port registration failure hsr: broadcast netlink notifications in the device's net namespace net: microchip: sparx5: clean up PSFP resources on flower setup failure ALSA: es18xx: check control allocation before private data setup netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() riscv: panic if IRQ handler stacks cannot be allocated btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF NFS: fix eof updates after NFSv4.2 fallocate/zero-range ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() RDMA/rtrs-srv: Fix integer underflow in process_read and process_write xprtrdma: Add request-pool slack for delayed recycling RDMA/mlx5: Create ODP EQ for non-pinned dmabuf MRs configfs_depend_prep(): pass configfs_dirent instead of dentry pds_core: quiesce DMA before freeing resources net: ibm: emac: mal: fix potential system hang in mal_remove() tls: Flush backlog before waiting for a new record platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen wifi: mt76: mt7925: add Netgear A8500 USB device ID wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv wifi: mt76: transform aspm_conf for pci_disable_link_state netconsole: take target_cleanup_list_lock in drop_netconsole_target() btrfs: protect sb_write_pointer() with invalidate lock fbcon: don't suspend/resume when vc is graphics mode PCI: Avoid FLR for MediaTek MT7925 WiFi hwmon: (raspberrypi) Fix delayed-work teardown race hwmon: (adt7462) Add of_match_table to support devicetree btrfs: use on-disk uuid for s_uuid in temp_fsid mounts btrfs: use lockless read in nr_cached_objects shrinker callback net: dsa: qca8k: Add support for force mode for fixed link topology net: lan966x: restore RX state on reload failure vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add() vdpa/octeon_ep: Use 4 bytes for mailbox signature ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 ata: libata-pmp: add JMicron JMS562 quirk platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table nvme-fc: Do not cancel requests in io target before it is initialized sctp: Unwind address notifier registration on failure HID: multitouch: Honor ContactCount for Yoga Book 9 to suppress ghost contacts hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i spi: xilinx: let transfers timeout in case of no IRQ Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 Bluetooth: btusb: Add support for TP-Link TL-UB250 Bluetooth: L2CAP: validate connectionless PSM length Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 sparc64: uprobes: add missing break net: stmmac: xgmac2: disable RBUE in default RX interrupt mask ptp: ocp: add shutdown callback vsock: use sk_acceptq_is_full() helper in all transports e1000e: limit endianness conversion to boundary words net: hns3: improve the unused_tuple parameter setting net/sched: act_csum: don't mangle UDP tunnel GSO packets smb: client: fix races in cifsd thread creation i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA bpftool: Pass host flags to bootstrap libbpf sparc: Disable compat support with LLD exfat: fix handling of damaged volume in exfat_create_upcase_table() ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT virtio-fs: avoid double-free on failed queue setup HID: hidpp: fix potential UAF in hidpp_connect_event() fuse: set ff->flock only on success scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() gpio: pisosr: Read "ngpios" as u32 spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() ALSA: usb-audio: Add quirk flags for SC13A tls: reject the combination of TLS and sockmap ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 leds: uleds: Return -EFAULT on copy_to_user() failure leds: pca9532: Don't stop blinking for non-zero brightness mfd: tps65219: Make poweroff handler conditional on system-power-controller leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE mfd: rsmu: Add 8a34002 support drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap drm/amdgpu: Use system unbound workqueue for soft IH ring ALSA: usb-audio: Add quirk for YAMAHA CDS3000 drm/amdkfd: Properly acquire queue buffers in CRIU restore PCI: iproc: Protect root bus removal with rescan lock PCI: altera: Protect root bus removal with rescan lock PCI: rockchip: Protect root bus removal with rescan lock PCI: mediatek: Protect root bus removal with rescan lock PCI: plda: Protect root bus removal with rescan lock perf: Fix addr_filter_ranges lifetime mailbox: imx: Use devm_pm_runtime_enable() md/raid5: account discard IO mailbox: imx: Add a channel shutdown field mailbox: imx: use devm_of_platform_populate() md/raid5: let stripe batch bm_seq comparison wrap-safe ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 f2fs: validate inline dentry name lengths before conversion rtc: mv: add suspend/resume support for wakeup rtc: aspeed: add AST2700 compatible ksmbd: fix lease break and ack state handling ksmbd: validate SMB2 lease create contexts ksmbd: align SMB2 oplock break ack handling ksmbd: use connection ClientGUID for lease lookup ksmbd: treat unnamed DATA stream as base file ksmbd: apply create security descriptor first ksmbd: deny renaming directory with open children ksmbd: start file id allocation at 1 ksmbd: break RH leases before delete-on-close ksmbd: treat read-control opens as stat opens only for leases PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() PCI/sysfs: Use kstrtobool() to parse the ROM attribute input regulator: da9121: Use subvariant ids in the I2C table net: au1000: move free_irq out of the close-time spinlocked section blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat() rtc: bq32000: add delay between RTC reads eth: mlx5: fix macsec dependency ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk fbdev: pm2fb: unwind WC setup on probe failure ASoC: tas2781: Update default register address to TAS2563 spi: core: Abort active target transfer on controller suspend btrfs: tree-checker: validate INODE_REF's namelen drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend netfilter: nf_conntrack_expect: zero at allocation time ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED drm/arm/komeda: fix error handling for clk_prepare_enable() and callers ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling xen/front-pgdir-shbuf: free grant reference head on errors freevxfs: don't BUG() on unknown typed-extent type xen/gntalloc: validate grant count before allocation cachefiles: Fix double fput netfs: Fix decision whether to disallow write-streaming due to fscache use ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table drm/amdgpu: flush pending RCU callbacks on module unload ksmbd: fix credit charge calculation for SMB2 QUERY_INFO ALSA: usb-audio: caiaq: validate EP1 reply lengths wifi: ralink: RT2X00: init EEPROM properly wifi: mac80211: validate deauth frame length before reason access wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers wifi: libertas: reject short monitor TX frames wifi: cfg80211: validate assoc response length before status and IE access ksmbd: find bound sessions during reauthentication ksmbd: mark invalid session responses as signed ksmbd: validate SID namespace before mapping IDs wifi: cfg80211: validate rx/tx MLME callback frame lengths before access wifi: mac80211: ibss: wait for in-flight TX on disconnect gpio: dwapb: Mask interrupts at hardware initialization wifi: libipw: fix key index receive bound checks netfilter: ipset: mark the rcu locked areas properly wifi: rsi: validate beacon length before fixed buffer copy ASoC: rt712-sdca: reset codec at io_init to fix silent headphone cifs: Fix support for creating SFU socket smb/client: zero-initialize stack-allocated cifs_open_info_data ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) ALSA: hda: cs35l56: Fail if wmfw file is missing cifs: Fix support for creating SFU fifo btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr() btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() spi: dw-dma: Wait for controller idle before completing Tx wifi: iwlwifi: mvm: validate sta_id in BA window status notif btrfs: fix reloc root cleanup in merge_reloc_roots() wifi: iwlwifi: mvm: validate mac_link_id in session protect notif wifi: iwlwifi: mvm: fix an off-by-1 boundary check wifi: iwlwifi: mvm: parse beacon notif per layout wifi: iwlwifi: mvm: fix sched scan IE sizing wifi: iwlwifi: pcie: null RX pointers after free ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs blk-cgroup: fix leaks and online flag on radix_tree_insert failure smb/client: flush dirty data before punching a hole ASoC: Intel: sof_sdw: Add quirks for new Dell laptops wifi: iwlwifi: mvm: validate TX_CMD response layout wifi: iwlwifi: mvm: fix a possible underflow arm64: fixmap: Allow 256K early_ioremap() at any offset wifi: iwlwifi: mvm: add a check on the tid coming from the firmware wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif arm64: kprobes: Allow reentering kprobes while single-stepping drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized ALSA: hda/realtek: Add quirk for HP Pavilion x360 wifi: iwlwifi: bound aligned TLV advance in FW parser ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless wifi: iwlwifi: acpi: validate WGDS table revision index ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE wifi: mwifiex: replace one-element arrays with flexible array members smb: client: bound dirent name against end of SMB response in cifs_filldir regulator: core: clamp voltage constraints before applying apply_uV wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO ksmbd: preserve VFS inherited POSIX ACL mask drm/gma500: return errors from Oaktrail HDMI I2C reads phonet: check register_netdevice_notifier() error in phonet_device_init() ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx ice: pass the return value of skb_checksum_help() powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash cifs: validate idmap key payload length wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) ata: libata-core: Disable LPM on some WD drives ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) ata: libata-core: Disable LPM on WD Green 2.5 480GB Drivers: hv: vmbus: add VTL2 redirect connection ID ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx vhost-scsi: flush backend after device ioctls hwmon: (corsair-psu) Fix linear11 calculation ata: libata-core: Disable LPM on WDC WD141KFGX-68FH9N0 spi: dw: fix wrong RX_SAMPLE_DLY setting after resume ASoC: rt5645: Perform the initial jack detect at probe scsi: core: Do not block on tag allocation in scsi_eh_lock_door() ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state bpftool: Strip all -Wformat* flags from bootstrap libbpf build ksmbd: remove stale channels from all sessions on teardown iommu/arm-smmu-v3: Disable implementations during devm teardown wifi: mt76: mt7921: validate CLC firmware records wifi: mt76: mt7921: skip unknown CLC firmware records leds: st1202: Validate pattern input before stopping the sequence ppp_async: drop the errored frame instead of resetting its headroom ARM: ensure interrupts are enabled in __do_user_fault() RAS/AMD/ATL, EDAC/amd64: Only load ATL when needed EDAC/igen6: Fix interleave boundary condition EDAC/igen6: Fix channel selection hash EDAC/igen6: Fix channel address decode for non-hash mode EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() drm/virtio: use the DMA API for resource backing on Xen accel/qaic: Address potential out-of-bounds read in resp_worker() nvme-rdma: fix -EIO cleanup order in queue_rq nvmet-rdma: fix queue leak when connect backlog is exceeded sched_ext: Fix nonexistent field in sched-ext.rst example selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic drm/gud: validate GUD_ROTATION_0 is present in supported rotations accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain ufs: do not treat unreadable directory blocks as empty drm/cirrus-qemu: Validate BAR0 size during probe net: icmp: avoid invalid transport header access in icmp_send tracepoint tcp: use GFP_ATOMIC in tcp_send_active_reset() net: iptunnel: fix stale transport header during tunnel decapsulation net/sched: act_api: budget all shared attributes in notify skbs net/sched: act_api: size the RTM_GETACTION reply from the actions net/sched: act_api: fix skb sizing and action leak on reoffload delete sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() smb/client: validate new EOF for insert range smb/client: validate new EOF for zero range smb/client: mark file sparse before emulating insert range smb/client: fix data corruption in emulated insert range smb/client: fix integer truncation in collapse range smb: client: transport: Fix debug printing in __release_mid() sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration raw: annotate disconnect-side IPv4 match writers net: amd-xgbe: discard rx packets with bad FCS vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() watchdog: msc313e: Fix NULL pointer dereference in PM callbacks perf symbol: Do not use debug file as the binary type OPP: of: Fix potential multiplication overflow when calculating freq perf powerpc-vpadtl: Fix raw_size of DTL samples netfs: Fix unbuffered/DIO write partial transfer error return netfs: Fix error vs transferred passed to ->ki_complete() netfs: Fix i_size update for partial transfer netfs: Fix subreq ref leak netfs: break unbuffered write when netfs_alloc_subrequest() fails cachefiles: Fix potential UAF/KASAN warning ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF ksmbd: propagate DACL parsing errors ksmbd: rate limit unmapped SID errors s390/time: Use jiffies instead of jiffies_64 s390/ipl: Fix NULL deref in kdump without re-IPL parm block s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block s390/diag324: Preserve -EBUSY return code sched_ext: Fix timer pinning and return value in scx_central sched_ext: Update demo schedulers and selftests to use scx_bpf_task_set_dsq_vtime() sched_ext: Fix vtime delta loss in scx_flatcg cgroup migration Bluetooth: btintel_pcie: Clear automask on spurious interrupts workqueue: reject watchdog thresholds that overflow jiffies Bluetooth: btintel: validate version TLV value lengths Bluetooth: btintel: bound firmware ID by TLV length Bluetooth: hci_core: Fix race condition during device registration Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() ASoC: ab8500: Reset the audio block before configuring it ASoC: ab8500: Repair the DAPM capture graph ASoC: ab8500: Correct digital interface format setup ASoC: ab8500: Validate and program TDM slots correctly net: ethernet: oa_tc6: Interrupt is active low, level triggered. net: ethernet: oa_tc6: Handle the OA TC6 SPI protected mode net: ethernet: oa_tc6: Export standard defined registers net: ethernet: oa_tc6: Add the OA_TC6_ prefix to standard registers net: ethernet: oa_tc6: Protect skb pointer used by two different kernel instances net: ethernet: oa_tc6: Improve the error recovery net: ethernet: oa_tc6: Disable tx queues on fatal error net: ethernet: oa_tc6: Fix for the wrong data type net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted igmp: convert struct ip_sf_list to RCU ppp: ppp_async: simplify tty disc_data access ppp: ppp_synctty: simplify tty disc_data access ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit tipc: fix NULL deref in tipc_named_node_up() on empty publication list tipc: Dont send random pad bytes in RESET/ACTIVATE messages ipv6: sr: restore network header before routing and forwarding af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). staging: fbtft: make dirty_lock IRQ-safe ALSA: hda: restore MFG widget enumeration after core split s390/boot: Fix physical memory search range s390/boot: Avoid IPL parameter append past command line ASoC: fsl_micfil: balance mclk enable/disable ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl() ALSA: dummy: Report a change when one capture switch channel moves btrfs: detach failed sprout device from transaction update list btrfs: restore active device pointers after failed sprout bonding: alb: fix uninitialized transport header access in alb_determine_nd() perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate x86/itmt: Don't make ITMT enablement depend on debugfs perf/core: Skip empty AUX records with only format flags locking/lockdep: Invalidate stale class_cache entries for zapped classes octeontx2-af: Fix limiting SRIOV VF count logic ALSA: ump: do not touch legacy_rmidi before it exists printk/nbcon: Change nbcon_irq_work to IRQ_WORK_LAZY ASoC: ux500: Fix MSP stream lifecycle handling ASoC: ux500: Propagate MSP setup errors ASoC: ux500: Correct MSP frame and bit clock setup ASoC: ux500: Validate MSP DAI configuration mfd: db8500-prcmu: Fold dbx500 header into db8500 ASoC: ux500: Deassert the MSP reset during probe ASoC: ux500: Request the MSP MMIO resource ASoC: ux500: Remove obsolete PRCMU QoS calls ASoC: ux500: Allow repeated MSP prepare calls ASoC: ux500: Program the MSP FIFO watermarks btrfs: scrub: report the failing sector's address, not the stripe base btrfs: fix transaction use-after-free in raid stripe insertion btrfs: fix the possible bioc_list memory leak during error btrfs: return proper negative error code for update_raid_extent_item() btrfs: zoned: finish active block group cleanup if call_zone_finish() fails btrfs: send: fix lost error return value in will_overwrite_ref() btrfs: do not force reloc root creation during qgroup_account_snapshot() btrfs: zstd: fix lost wakeup when waiting for a workspace drm/amdgpu/userq: fix struct drm_amdgpu_info_device padding for 32bit compile ipvs: fix reversed sequence option serialization netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() tracing/probes: Fix use-after-free on field name/type of events with multiple probes bpf: reject BPF_PSEUDO_FUNC reference to the main program bonding: do not clear curr_active_slave prematurely when releasing all slaves net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). net/rds: use wq_has_sleeper() in release_in_xmit() net/rds: use clear_bit_unlock() in release_refill() net/rds: clear cp_flags bits individually in rds_conn_path_reset() net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() net/rds: acquire the fastpath locks in rds_conn_shutdown() net/rds: don't let rds_conn_shutdown() consume a concurrent drop net: airoha: enable RX_DONE interrupt for RX queue 31 net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list() arm64: trans_pgd: clone only the linear map that exists at runtime erofs: disable LZ4 rolling decompression for now selftests/alsa: Fix the step check for INTEGER controls ALSA: caiaq: Fix potential double-free at error path drm/rockchip: dw_dp: Select DRM_BRIDGE_CONNECTOR drm/rockchip: rk3066_hdmi: Add missing Kconfig selects bpf: Fix NULL-ptr-deref when showing a void BTF type bpf: Fix NULL-ptr-deref in btf_var_show() bpf: Mark signal tracepoint siginfo arguments as scalar bpf: Reject tail calls directly from callback frames bpf: Reject resilient lock operations in rbtree callbacks bpf: Mark sched_process_wait argument as nullable nvme: remove stale namespaces by NSID range during scan nvme-tcp: defer TLS inline send to io_work ASoC: Intel: avs: Clean up the bus when fetching ML caps fails ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology ASoC: Intel: avs: Fix unbalanced module reference count ASoC: Intel: avs: Refactor and fix init_config access net: bcmasp: clear txcb->last before writing each descriptor net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context bpf: Only enforce 8 frame call stack limit for all-static stacks bpf: share several utility functions as internal API bpf: Print breakdown of insns processed by subprogs bpf: Report maximum combined stack depth bpf: Track verifier instruction stats for each subprogram bpf: Check ancestor frames for rbtree callbacks bpf: Mark bpf_btf_find_by_name_kind() as sleepable bpf: Mark faultable stack helpers as sleepable bpf: Reject legacy packet loads from callbacks bpf: Don't predict JMP32 pointer vs zero comparisons thermal: sysfs: switch to use scnprintf() to suppress truncation warning bpf: Require MEM_PERCPU for percpu kptr stores bpf: Reject untrusted allocated-object pointers tracing: Fix to avoid creating trace instances with duplicate names selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0 nexthop: Initialize extack in remove_nh_grp_entry() bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit() net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size eth: nfp: bound the ntuple rule dump by the caller's buffer size eth: nfp: drop the replaced rule from the list when reprogramming fails net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size net: bridge: mcast: properly convert mglist to rcu octeontx2-af: mcs: Clear stale X2P calibration state before calibration ionic: use netif_txq_maybe_stop() in ionic_tx() net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow dibs: change dibs_class to a const struct dibs: Unregister dibs_class after error s390/ism: folio_put() after error vxlan: reject dynamic fdb entries that reference a nexthop id net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations net: reject oversized tx_queue_len at netlink parse time pds_core: fix cmd_regs access racing BAR unmap on reset pds_core: don't release PCI regions for VFs on reset powerpc/kexec_file: Use inclusive range checks in add_usable_mem() powerpc/kexec_file: Use inclusive range checks for excluded memory net: mctp: i3c: serialize probe with bus removal net/sched: defer qdisc freeing after failed creation net/mlx5e: Fix missing FEC mode mapping for RS_544_514_INTERLEAVED_QUAD net/mlx5e: Fix setting RS FEC after remapping net/mlx5: LAG, use local tracker to update active ports net/mlx5e: Fix ETS zero BW reporting when one TC holds 100% net/mlx5e: Fix use-after-free race in sample_restore_put() net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put net/mlx5: E-Switch, prevent mc_list repopulation during vport disable net/mlx5e: Keep HW timestamp stats monotonic across reconfiguration net/sched: fq_pie: clamp quantum in change path net/sched: sfq: clamp quantum in change path net/sched: hhf: clamp quantum in change and init paths net/sched: dualpi2: clamp psched_mtu at all call sites net/sched: pie: clamp psched_mtu in pie_drop_early net/sched: drr: clamp quantum in change class net/sched: ets: clamp quantum in parse and fallback paths net: macb: fix NULL pointer dereference on unbind with fixed-link bpf: Reject non-scalar bpf_loop iteration counts ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev iommu/riscv: Add command queue lock iommu/riscv: Disable SADE iommu/amd: Add NUMA node affinity for IOMMU log buffers iommu/amd: Do not reallocate GA log buffers on resume iommu/amd: Fix premature break in init_iommu_one() again hwmon: (ltc4282) Make sure clk_init_data is fully initialized Documentation/hwmon: Document hwmon_notify_event() hwmon: Fix potential UAF in pec_store hwmon: (ina2xx) Acquire hwmon_lock in shunt_resistor_show() hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() hwmon: (ina2xx) Replace masks with enum in alert functions hwmon: (ina2xx) Decouple in0 and curr1 alarms Documentation: hwmon: replace full-width colon by a standard ASCII colon hwmon: (sht4x) Fix return value from heater_enable_store() ASoC: bcm: bcm63xx: Publish the OF module aliases ASoC: Intel: SST: Publish the PCI module aliases netfilter: nfnetlink_log: cope with concurrent instance destruction netfilter: ip6_tables: set F_PROTO when proto value is nonzero ASoC: mt6351: Publish the OF module alias irqchip/gic-v5: Preserve ICC_CR0_EL1 state virtio: fix use-after-free in unregister_virtio_device() virtio_console: do not free control-out buffers on remove vhost/vdpa: reject VRING_NUM larger than device max vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx vhost-vdpa: protect config_ctx from being freed under the config callback vdpa_sim_blk: reject out-of-range sector starts vdpa_sim_net: check TX pull result before RX copy virtio-pci: return IRQ_HANDLED after non-zero ISR virtio_input: reset device if input_register_device() fails virtio_input: stop callbacks before unregistering input device af_unix: Update last skb marker in manage_oob(). af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer. net: ipv4: Fix UDP length overflow with PMTU discover and big MTU net: ipv6: Fix UDP length overflow with PMTU discover and big MTU net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward net: ethernet: cortina: Fix budget accounting net: ethernet: cortina: Finish RX updates before NAPI completion net: ethernet: cortina: Count dropped frames as NAPI work net: ethernet: cortina: No mapping is a dropped rx net: ethernet: cortina: Count RX drops once per frame net: ethernet: cortina: Count RX descriptors for freeq refill drm/adp: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER ALSA: hda: Report a change when only the channel status bytes move idpf: account for VLAN header when parsing RSC packet header ice: add missing xa_destroy for sched_node_ids eth: ice: don't dereference pointers from TP_printk() Bluetooth: btusb: Fix UAF of btusb_data by rx_work Bluetooth: btintel_pcie: validate packet_len before skb_put_data Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() Bluetooth: btusb: mediatek: Fix leaked runtime PM reference in reset Bluetooth: btusb: Fix leaked runtime PM reference in btusb_reset net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings() net: macb: destroy the phylink instance on the probe error path net: macb: put the "mdio" child node reference on success mptcp: remove unneeded READ_ONCE() annotation watchdog: fix hrtimer start when pretimeout is zero watchdog: msc313e: Avoid division by zero watchdog: msc313e: Fix clock leak and spurious timer in settimeout() watchdog: msc313e: Enable clock before accessing hardware registers watchdog: msc313e: Fix spurious reset on suspend watchdog: msc313e: Fix undefined behavior watchdog: msc313e: Sync timeout value if WDT was running at boot net: dsa: lantiq_gswip: fix GSWIP_MDIO_PHY_FCONTX_EN value net: ks8851: Fix receiver error in 100BASE-TX mode following software power-down hwmon: (corsair-cpro) Create debugfs entries after hwmon registration hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors hwmon: (corsair-cpro) Remove debugfs entries when probe fails hwmon: (nct6694) do not expose enable on DTIN temperature channels octeontx2-pf: reset HTB scheduler topology before freeing queues vxlan: initialize _md in vxlan_xmit_one() ppp_synctty: ensure a writeable skb header net: stmmac: initialize ptp_lock at probe time devlink: Refactor resource functions to be generic devlink: Add port-level resource registration infrastructure net/mlx5: Register SF resource on PF port representor net/mlx5e: Move representor vnic reporter to eswitch devlink port selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value perf/core: Allow list_del during perf_event_overflow() perf/x86/intel: Correct pt_regs->flags update for PEBS path perf/x86/intel: Prevent drain_pebs() reentry sched/eevdf: Fix augmented max_slice sched/eevdf: Fix rb augmented with multi fields sched: Account cgroup CPU time to the execution context sched/core: Call wq_worker_tick() for the execution context net/sched: cls_route: free emptied bucket on filter move net/sched: cls_route: Reject handle aliasing net/sched: cls_route: Fix in-place replace net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). net: sun4i-emac: fix missing of_node_put() for phy_node net: hinic: fix mailbox segment buffer overflow net: dsa: mt7530: add EN7528 support net: dsa: mt7530: populate lpi_interfaces to fix EEE support net: ethernet: mtk_eth_soc: avoid writing to ESW registers on MT7628 net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support net: phy: mediatek-ge: disable EEE on the MT7530 PHY net: net_failover: Fix the deadlock in net_failover_slave_name_change() octeontx2-af: fix PF/CGX debugfs PCI bus lookup net: phy: dp83867: handle the active-high LED polarity mode net: mana: restore the XDP program pointer when pre-allocation fails net/rds: fix tcp stream corruption with large pages net: stmmac: fix TSO support when some channels have TBS available net: stmmac: add stmmac_tso_header_size() net: stmmac: add TSO check for header length net: stmmac: fix TX descriptor availability check for TSO traffic net: hsr: enable promiscuous mode on interlink port with fwd offload openvswitch: fix wrong flag value in get_ipv6_ext_hdrs() sunvdc: unmap LDC cookies when the descriptor send fails erofs: add missing buf->off in erofs_bread() scripts/mksysmap: drop the MODULE_INFO() symbols from kallsyms scripts/mksysmap: fix escape of '$' in the __pi_ pattern scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands ksmbd: prevent out-of-bounds reads in share config responses configfs: pin the symlink target's dirent instead of chasing ->ci_dentry powerpc/ps3: Fix repository.c build failure powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver powerpc: pci-ioda: Fix the stale irq chip reference x86/amd_node: Avoid divide by zero on virtualized systems x86/amd_node: Fix potential NULL pointer dereference crypto: x86/aria - add missing vzeroupper in AVX2 code crypto: x86/aria - add missing vzeroupper in AVX-512 code x86/amd_node: Fix PCI device reference counting in amd_smn_init() x86/mm: Fix user-space data loss with MADV_FREE and THP x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash() x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF x86/alternatives: Exclude text poking against change_page_attr() ipv6: fix fib6 walker UAF on seq stop reboot: fix cad_pid use-after-free race tracing: Fix memory corruption from the histogram stacktrace modifier tracing: Restore :mod: trailer after parsing in ftrace_set_clr_event() tracing: Fix memory corruption from a "STACKTRACE" histogram key rust: allow `clippy::as_underscore` in the generated bindings rust: allow `unknown_lints` in generated bindings for Rust < 1.88 drm/panic: clean new `clippy::needless_range_loop` lint for Rust 1.100.0 ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough ALSA: us122l: Prevent write upgrades for read mappings ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf ALSA: usbusx2y: validate URB actual_length in interrupt callback Revert "riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set" dm/amdgpu: fix malformed link_settings debugfs output drm/amdgpu: skip gfx switch_power_profile during GPU reset watchdog: sunxi_wdt: preserve boot-enabled watchdog virtio_mmio: disable IRQ wake before free_irq ufs: create the root dentry after loading cylinder metadata ufs: validate cylinder group metadata before caching it tunnels: Drop stale dst when building an ICMP error for PMTUD tick/broadcast: Plug clockevents replacement race tools/bootconfig: Fix integer overflow and truncation in size checks tracing/user_events: Don't destroy fields when event removal fails tracing: Free histogram the var ref when its initialization fails tracing: Free histogram var refs regardless of how often they are referenced tracing: Free histogram the field rejected for a bad modifier tracing: Let histogram values keep the percent and graph modifiers tracing: Keep the entry count when the histogram stats allocation fails accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr accel/ivpu: Validate firmware log buffer metadata accel/ivpu: Limit firmware log name prints to field size ASoC: sprd: validate compress buffer sizes against fixed allocations ASoC: sti: initialize IRQ lock before requesting IRQ Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 cpufreq: zero-initialize policy cpumask before sysfs publication cpufreq: initialize policy rwsem before sysfs publication exec: do_close_on_exec() before taking exec_update_lock fs: don't return -EINVAL for successful nested thaw function_graph: Use the saved entry's size when reprinting it drm/bridge: tc358768: Enforce input bus flags via atomic_check drm/drm_exec: fix up contended obj when num_objects is 0 drm/i915: Fix memory leak in query_perf_config_list() drm/rockchip: analogix_dp: fix unchecked bound endpoint name length drm/sched: Create a fake device for KUnit tests io_uring/net: let io_recv_buf_select return the length of the buffer region io_uring/net: don't overconsume buffers when using MSG_TRUNC ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters() ring-buffer: Check resize_disabled before publishing the new subbuf order net/sched: act_api: release all action references on NEWACTION failure net: bridge: use option bits for CFM/MRP frame handlers net: dsa: tag_brcm: legacy FCS: request needed tailroom net: hso: fix TIOCMIWAIT race net: mana: Reserve extra CQ slot for the fence completion CQE net: mpls: clear inner_protocol when the last label is popped net: openvswitch: fix use-after-free of the flow table mask array net: phy: dp83td510: handle the active-high LED polarity mode netfs: Fix uninitialized return value in netfs_unbuffered_write() netfilter: nf_log: unregister loggers before per-net teardown netfilter: report NLM_F_DUMP_FILTERED when all is filtered out vdpa: ifcvf: Put device on unsupported feature error vdpa: solidrun: Free IRQs after request failure scripts/sorttable: Mark long_size as __maybe_unused fs: autofs: fix memory leak in autofs_fill_super() erofs: preserve LZMA decoders on resize failure fbdev: vfb: defer cleanup until the last reference inet: frags: invalidate queues before flushing them ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink ieee802154: cc2520: fix FIFOP work use-after-free ieee802154: hwsim: serialize pib updates to fix double-free ipv4: fib: bound automatic table ID allocation ipv6: flowlabel: cap duplicate leases per socket ipvs: reject invalid states in connection template sync records mac802154: fix use-after-free of sdata via queued RX frames KVM: PPC: Book3S HV: Set irqfd->producer only on success iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX s390/qeth: allow bridgeport queries despite OS_MISMATCH s390/crypto: Fix skcipher_walk return code handling in aes_s390 s390/crypto: Fix use of mutex in atomic context s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm s390/crypto: Fix missing cra_flags in paes_s390 s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine s390/crypto: Fix missing scrub of temp buffers with PAES algorithm s390/crypto: Fix wrong return code to engine in asynch callbacks s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly perf: RISC-V: store available counter mask as bitmap perf: RISC-V: use BIT_ULL for u64 overflow masks afs: Fix missing kunmap in afs_dir_search_bucket() afs: Fix double-unmap of directory block afs: Fix incorrect free in candidate cleanup in afs_lookup_server() afs: Clear stale peer app data after address list changes hwmon: (applesmc) fix key backlight workqueue leak on register failure hwmon: (chipcap2) fix channels in humidity alarm notifications hwmon: (gpio-fan) Fix use-after-free in alarm work hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS media: hevc: add bounded tile-count helpers media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity media: v4l2-h264: Fix memcmp() size in B1 reference list comparison media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity media: v4l2-ctrls: validate HEVC tile counts media: v4l2-ctrls: validate AV1 tile counts bnxt_en: Only restore LRO if the device supports TPA bnxt_en: Don't free the live ring's TPA state on queue restart failure bnxt_en: Propagate RX ring init failures in bnxt_init_nic() bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() mptcp: options: handle MPC data + csum reqd + no csum mptcp: subflow: no need to copy thmac during ulp_clone mptcp: syncookies: remember the request backup flag selftests: mptcp: fix an UAF in mptcp_connect.c mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 mptcp: pm: userspace: fix address ID overflow smb: client: reject userspace cifs.idmap descriptions smb: client: reject short READ responses in CIFSSMBRead() smb: client: pin DFS superblock in iterator callback smb: client: fix one-byte OOB read in smb2_parse_native_symlink() smb: client: fix file type corruption in cifs_reparse_point_to_fattr() smb: client: fix file type corruption in posix_reparse_to_fattr() smb: client: fix file type corruption in wsl_to_fattr() smb: client: avoid leaking refcount in cifs_queue_oplock_break() smb: client: avoid leaking refcount when cifs_sb_tlink() fails smb: client: fix heap overflow in DACL owner/group rewrite xfs: use the rtgroup extent count to find rtrefcount gaps xfs: truncate quota file correctly when repairing quota file xfs: strengthen the "is cow staging" helpers in scrub xfs: snapshot scrub stats when rendering them xfs: snapshot old AGFL before rewriting it xfs: signal inode btree xref error if get_rec returns an error xfs: reset parent pointer args before each dir tree unlink repair xfs: report nonexistent parents as a filesystem corruption xfs: report healthy filesystem events in scrub stats xfs: release alleged child inode on metapath unlink error xfs: preserve owner on in-memory btree creation xfs: make the rtsummary repair fix the file size too xfs: log the tempip after we convert it to extents format xfs: initialise error in xfs_defer_finish_one() xfs: fix xfs_rtrmapbt_mem_cursor for non-rmap filesystems xfs: fix unit conversions in per_binval computation xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions xfs: fix short ifork reaping computation in xreap_bmapi_binval xfs: fix rtrmap cross-referencing elision logic xfs: fix rtrefcount btree block counting in scrub xfs: fix replaying dirent removals into the temporary directory xfs: fix reclaimed page accounting in xfs_buf_free xfs: fix parent rec lookup initialization in xrep_metapath_unlink xfs: fix name string recording in slowpath pptr tracepoints xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN xfs: fix bnobt repair space reservation disposal failure xfs: fix backwards skipping logic in xrep_quota_block xfs: fix backwards mergeability logic in refcount scrubber xfs: don't spin forever on zero-length dirents when salvaging them xfs: don't modify file attributes or poke fsnotify for dry runs xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails xfs: don't leak dqacct if rhashtable insertion fails xfs: destroy seen inode bitmap when we fail to add a dirpath xfs: cross-reference the rtgroup superblock extent, not block xfs: count escaped corruption errors in scrub stats xfs: compute dquot checksum after resetting dd_lsn in repair xfs: bail out on bitmap errors in xrep_agfl_fill xfs: advance the findparent inode scan cursor while holding ILOCK xfs: actually recover intended file sizes in xfs_xmi_item_recover_intent xfs: actually check internal-rtdev fields in the superblock hwmon: (sht4x) Add missing locks ksmbd: don't hold ci->m_lock while waiting for a lease break ack crypto: ccp - Fix possible deadlock in SEV init failure path usb: xusbatm: don't rely on id table pointer arithmetic wifi: ath9k_htc: don't store usb_device_id usb: usbtmc: don't store usb_device_id usb: serial: spcp8x5: don't store usb_device_id media: as102: do not rely on id table address comparison net: usb: pegasus: don't rely on id table pointer arithmetic i2c: smbus: reject oversized block transfers in the common path net: appletalk: fix NULL pointer dereference in aarp_send_ddp() media: remove conditional return with no effect media: qcom: iris: fix runtime PM reference leaks scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate scsi: qla2xxx: Skip vport under deletion in report ID acquisition scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature scsi: qla2xxx: Clamp max_npiv_vports to VP_CTRL bitmap capacity scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] f2fs: accurately adjust free_sections during free_segment_range Revert: "f2fs: check in-memory block bitmap" drm/amdgpu: add a helper to calculate ring distance drm/amdgpu: reorder IB schedule sequence drm/amdgpu: Make amdgpu_vm_flush() non-failing in submission path drm/amdgpu: plumb timedout fence through to force completion i2c: designware: Global register definitions drm/pagemap: dma-unmap pages before handling migration errors ipmr: account multicast table and route memory x86/mm/pat: Convert split_large_page() to use ptdescs x86/mm/pat: Don't gate cpa_lock on debug_pagealloc_enabled() x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF x86/mm/pat: Allocate split page tables as kernel page tables bootconfig: Fix integer overflow in initrd size check genetlink: pin family module during policy dump io_uring/rw: end write accounting from ->ki_complete drm/amd/display: Rebuild InfoFrames on output color space changes drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches drm/amd/display: Propagate HDMI RGB quantization selectability drm/amd/display: Honor Broadcast RGB for BT.2020 RGB output drm/bridge: ti-sn65dsi83: Fix error handling in sn65dsi83_reset_work() xfs: initialise args->total for parent pointer updates tracing: Set the trace clock before registering the histogram trigger tracing: Take the reference before publishing the named histogram trigger tracing: Undo the registration when enabling the histogram trigger fails EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout EDAC/altera: Use parent device for devres in altr_portb_setup() netfilter: cttimeout: prevent UAF during module unload exit: hold a reference to thread_pid across proc_flush_pid net: macb: Replace open-coded implementation with napi_schedule() net: macb: Use netif_napi_add_tx() instead of netif_napi_add() for TX NAPI net: macb: unify device pointer naming convention net: macb: initialize PTP state before registering clock erofs: add sysfs feature entry for xattr prefixes idpf: disable DIM work before freeing q_vectors landlock: Use mem_is_zero() in is_layer_masks_allowed() landlock: Fix use-after-free of the source's parent directory mptcp: pm: reset retrans_time when ADD_ADDR entry is reused bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() mptcp: do not reschedule the RTX timer for fallback sockets mptcp: prevent race between disconnect() and rtx smb: client: refactor ACL setting control flow in id_mode_to_cifs_acl() smb/client: fix security flag calculation when setting security descriptors smb: client: fail DACL rewrite when the new DACL exceeds 64K misc: amd-sbi: Add null check for devm_kasprintf() x86/mm: Fix and document DEBUG_PAGEALLOC mptcp: move the stale logic out of retrans scheduler mptcp: avoid unneeded actions on subflow reset mptcp: close race between scheduler and state change mptcp: fix bad accounting in __mptcp_subflow_push_pending() dm-pcache: validate seg_id fields from persistent memory btrfs: abort transaction before releasing tree_log_mutex on commit failure ksmbd: fix maximum allowed access checks smb/server: fix tree connection leak in smb2_tree_connect() ksmbd: fix tree connection use-after-free in smb2_tree_connect() drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader drm/connector: Introduce drm_output_color_format enum drm/display: hdmi: Use drm_output_color_format instead of hdmi_colorspace drm/display: hdmi-state-helper: Try subsampling in mode_valid cgroup/cpuset: Avoid unnecessary cpus & mems update in cpuset_hotplug_update_tasks() ARM: imx: avic: Fix OF node reference leaks ARM: OMAP2+: Fix OF node reference leaks in omap_hwmod firmware: imx: sm-misc: Add NULL check for kmalloc in syslog_show sched/core: Fix inter-class wakeup_preempt() perf/x86/intel/uncore: Fix PCI PMU cleanup on setup failure perf/x86/intel/uncore: Fix refcnt and other cleanups perf/x86/intel/uncore: Let init_box() callback report failures perf/x86/intel/uncore: Factor out box setup code perf/x86/intel/uncore: Introduce PMU flags and broken state perf/x86/intel/uncore: Fix uncore_box ref/unref ordering perf/x86/intel: Keep cap_user_rdpmc in sync with RDPMC user-disable state drm/panthor: Split panthor_vm_prepare_map_op_ctx() to prepare for reclaim drm/panthor: Pass vm_bind_op to vm_prepare_map_op_ctx workqueue: only show running workers in stall diagnostics wifi: ath12k: fix TLV32 length mask perf util: Sort includes and add missed explicit dependencies perf evlist: Add reference count perf evsel: Add reference count perf evlist: Add reference count checking perf parse-events: Restrict core PMU bypass to --cputype option perf tests: Fix Python JIT dump profiling test failure drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read drm/amd/display: Fix dangling pointer in plane reset function dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout wifi: rtw89: fw: correct preload field of w2 in rtw89_fw_h2c_default_cmac_tbl_be() wifi: rtw89: fw: fix link ID filling for LPS MLO common info uprobes/x86: Remove struct uprobe_trampoline object uprobes/x86: Do not leak trampoline vma mapping on optimization failure uprobes/x86: Allow to copy uprobe trampolines on fork uprobes/x86: Move optimized uprobe from nop5 to nop10 perf cs-etm: Filter synthesized branch samples libbpf: Add uprobe syscall feature detection libbpf: Add support to detect nop,nop5 instructions combo for usdt probe libbpf: Change has_nop_combo to work on top of nop10 perf test amd ibs: avoid using executable heap perf vendor events amd: Update Zen 6 core events hwrng: omap - Fix probe error path cleanup RDMA/bng_re: return a timeout when firmware responses stall fuse: move "epoch" from dentry.d_time to fuse_dentry.epoch arm64: dts: qcom: monaco: fix wrong connection for the replicator arm64: dts: qcom: sc8280xp: sort reserved memory regions PCI: qcom: Skip PERST# GPIOs provided by downstream PCIe devices bpf: Reject MEM_ALLOC BTF accesses past object bounds perf record: fix poll storm when monitored threads exit bpf: Reject writes through untrusted BTF pointers bpf: Introduce jit_required flag and remove bpf_prog_has_kfunc_call() bpf: Reject programs with inlined helpers if JIT is not available arm64: dts: mediatek: tungsten-smarc: Remove unnecessary cells platform/x86: dell-wmi-base: Fix handling of ultra performance key bpf: Drop scalar id on sign-extending narrowing stack fills remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max usb: gadget: uac: validate rate list length before storing usb: typec: tcpm: fix EPR AVS APDO maximum voltage decoding platform/x86: asus-wmi: fix resource leaks on probe failure usb: chipidea: imx: fix missing ret assignment for dev_err_probe -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2169638 Title: Resolute update: upstream stable patchset 2026-10-05 Status in linux package in Ubuntu: Invalid Status in linux source package in Resolute: In Progress Bug description: SRU Justification Impact: The upstream process for stable tree updates is quite similar in scope to the Ubuntu SRU process, e.g., each patch has to demonstrably fix a bug, and each patch is vetted by upstream by originating either directly from a mainline/stable Linux tree or a minimally backported form of that patch. The following upstream stable patches should be included in the Ubuntu kernel: upstream stable patchset 2026-10-05 Ported from the following upstream stable releases: v6.18.52, v6.18.53, v7.2.6, v7.2.7 from git://git.kernel.org/ perf record: Fix teardown hang on system-wide multi-threaded sessions clk: spacemit: k3: fix parent clock of UFS aclk esp: do not unref managed frag pages in esp_ssg_unref() RDMA/rvt: Return NULL after port allocation failure tools/sched_ext: scx_flatcg: Fix uninitialized stats on allocation failure fs/resctrl: Fix UAF from worker threads when domains are removed arm64: dts: renesas: rzt2h-n2h-evk: Remove unused MII/GMII pins cxl/features: Serialize multi-part Get/Set Feature transfers wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback wifi: ath12k: fix MLO peer delete race wifi: ath12k: fix rx_mpdu_start layout for QCC2072 firmware: arm_scmi: Clear SystemPower flag on create failure firmware: arm_scmi: Fix OF node reference handling firmware: arm_scmi: Fix SCMI device destroy lifetimes PCI: keystone: Fix OF node reference leak in init media: ti: vpe: Select V4L2_FWNODE for VIP OPP: Fix cleanup ordering drm/amd/display: remove duplicate link_dp_panel_replay.h include arm64: dts: qcom: milos: Add reset for sdhc_2 perf sched: Add missing perf_session__delete() perf sched: Fix memory leaks in perf sched stats report perf sched: Free subcommand string after perf sched stats drm/solomon: remove unneeded variables in blit functions perf stat: Fix duplicate output with --for-each-cgroup gpu: host1x: Avoid double device_add when clients already present drm/msm/a6xx: Fix IRQ storm during msm_recovery test bpf: Sync tail_call_reachable with callee state on entry crypto: aspeed - Propagate platform_get_irq() errors tlclk: if sscanf() fails, fall back to 0, not random value gpib: use 'static inline' instead of 'extern inline' vfio: selftests: Add helper to set/override a vf_token vfio: selftests: Avoid VLAs soc: ti: knav_qmss_queue: Implement resource cleanup in remove() soc: ti: knav_qmss: Remove debugfs file on teardown drm/v3d: Drop unused drm_encoder.h include from v3d_drv.h drm/v3d: Extract v3d_job_add_syncobjs() helper drm/v3d: Migrate BO reservation locking to DRM exec drm/v3d: Introduce struct v3d_submit and convert CL/TFU/CSD ioctls drm/v3d: Make v3d_get_cpu_indirect_csd_params() a pure parser drm/v3d: Convert submit helpers to operate on struct v3d_submit drm/v3d: Associate BOs with every job that accesses them bpf: Disallow interpreter fallback for arena-related insns bpf: Disallow interpreter fallback for gotox insn bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn samples: rust: debugfs: fix excessive stack use selftests/bpf: Fix make install target ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() wifi: ath12k: advertise ieee_link_id in vdev start MLO params wifi: ath12k: fix ML-STA authentication timeout on QCC2072 wifi: ath12k: fix survey indexing across bands riscv: dts: spacemit: set console baud rate on K3 Pico-ITX board gpu: nova-core: correct RISC-V HALTED field clk: sunxi-ng: mux: fix determine helper rate propagation ASoC: spacemit: rename clock inputs to match binding perf evsel: Add bounds checking to trace point raw data accessors perf trace: Correct default cpumask formatting to hexadecimal bpf: Fix WARNING in bpf_tracing_link_release selftests/bpf: Fix missing allocation null checks in test_progs.c pinctrl: Kconfig: drop unneeded dependencies on OF_GPIO pinctrl: PINCTRL_STMFX should depend on CONFIG_OF pinctrl: fix unmet dependencies from missing GPIOLIB liveupdate: reject nonzero reserved value for SESSION_FINISH liveupdate: Reference count outgoing FLB data liveupdate: Remember FLB retrieve() status pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip scsi: ufs: core: Validate string descriptors scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags scsi: ufs: rpmb: Validate request frame length before parsing ACPI: bus: Avoid confusing complaints regarding missing _OSC features PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node PCI/pwrctrl: tc9563: Power off only the external ports in tc9563_pwrctrl_disable_port() gpu: nova-core: build SetRegistry entries dynamically gpu: nova-core: fix packed registry table size perf ui hists: In report UI ensure thread is set with reference counting remoteproc: qcom: pas: Add late attach support for subsystems remoteproc: qcom: q6v5: Request shutdown if crash is triggered host-side iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() PCI: Make pci_match_one_device() match on ID instead of device PCI: Fix dyn_id add TOCTOU PCI: Fix UAF when probe runs concurrent to dyn ID removal clk: rockchip: Fractional PLL coefficient on RK3588/RK3576 is two's complement clk: spacemit: k3: fix missing /2 factor in i2s sysclk dividers RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() nvmet: fix return status of RMI log page on allocation failure nvme-pci: return error when parsing a quirk string fails drm/panthor: Add vm_bind region with kbo range overlap check wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() media: qcom: iris: Remove duplicate HFI_PROP_OPB_ENABLE entry s390/vdso: Pass --eh-frame-hdr to the linker regulator: tps65185: handle gpiod_get_value_cansleep() error returns md/raid5: fix lockless max_nr_stripes reads md: remove REQ_NOWAIT support from raid1/10/456 md/raid1: restrict atomic write limits and handle runtime constraints PCI: dwc: ep: Clear MSI iATU mapping in dw_pcie_ep_cleanup() soc: qcom: pmic_glink_altmode: Define the TBT extradata properly arm64: dts: qcom: talos: Fix cpu6 1094.4MHz OPP frequency typo arm64: dts: qcom: kaanapali: Fix the PCIe iommu-map entries arm64: dts: qcom: monaco: Fix the PCIe iommu-map entries arm64: dts: qcom: qcs6490-radxa-dragon-q6a: Fix the PCIe iommu-map entries platform/chrome: lightbar: Limit payload to max packet size clk: qcom: dispcc-qcm2290: Move to the latest common qcom_cc_probe() model clk: qcom: dispcc-qcm2290: Enable runtime PM support clk: qcom: qcm2290: Set POLL_CFG_GDSCR flag for DISPCC and GPUCC GDSCs clk: qcom: qcm2290: Add RETAIN_FF_ENABLE flag for DISPCC and GPUCC GDSCs clk: qcom: qcm2290: Update DISPCC and GPUCC GDSC *wait_val values clk: qcom: gpucc-qcm2290: Drop pm_clk handling clk: qcom: gpucc-qcm2290: Move to the latest common qcom_cc_probe() model clk: qcom: gpucc-qcm2290: Keep the critical clocks always-on from probe iomap: avoid memset iomap when iter is done iomap: release the folio batch on iomap callback failures wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx() wifi: mt76: mt792x: add common USB transport reset helpers wifi: mt76: mt7921u: escalate broken USB transport to device reset wifi: mt76: mt792x: stop USB register access after bus hang wifi: mt76: connac: add NAN connection type wifi: mt76: add init_wiphy callback wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll wifi: mt76: fix HE DCM max-RU capability encoding wifi: mt76: fix out-of-bounds access in mmio copy helpers wifi: mt76: decode the full VHT Rx STBC capability field wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode wifi: mt76: cancel reset and rc work on device unregister wifi: mt76: report data NSS for STBC frames in RX rate decode drm/msm/dpu: Fix DMA SSPP REC block offsets on DPU v13 ARM: tegra: Fix OF node reference leaks in IRQ init arm64: tegra: Fix CMDQV interrupt type on Tegra264 perf unwind-libdw: Fix unwinding of multi-threaded processes perf libdw: Fix outer-frame name resolution and spurious "(inlined)" tag bpf: Reject >8 byte return values on return-reading trampoline paths wifi: mt76: mt7996: clear stale link state on full reset wifi: mt76: add offchannel check to mt76_roc_complete wifi: mt76: check chanctx before restoring channel after ROC wifi: mt76: optimize ROC for same-channel case wifi: mt76: send nullfunc PS frames on offchannel transitions wifi: mt76: set MT76_SCANNING when starting a hw scan wifi: mt76: mt7996: do not leave state behind after a failed WED attach wifi: ath12k: fix encrypted EAPOL TX in encap offload mode arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry wifi: nl80211: clean up color-change beacon data on errors wifi: brcmfmac: fix P2P action frame handling without device vif bpf: Fix mmap_lock deadlock on arena lock failure objtool/klp: Fix module name normalization for paths with dots objtool/klp: Normalize Module.symvers paths to module names objtool/klp: Fix false module dependencies caused by dead relocs objtool/klp: Extricate checksum calculation from validate_branch() objtool/klp: Create empty checksum sections for function-less object files objtool/klp: Fix --debug-checksum for duplicate symbol names objtool/klp: Add "objtool klp checksum" subcommand livepatch/klp-build: support patches that add/remove files livepatch/klp-build: switch to GNU patch and recountdiff livepatch/klp-build: report patch validation fuzz klp-build: Suppress excessive fuzz output by default modpost: Add __llvm_covfun and __llvm_covmap to section_white_list objtool/klp: Remove "objtool --checksum" objtool: Grow __cfi_* prefix symbols for all CFI+CALL_PADDING UBUNTU: [Config] Remove PREFIX_SYMBOLS from configs. objtool/klp: Add .klp.symid for sympos disambiguation klp-build: Print "objtool klp diff" command in verbose mode klp-build: Use "objtool klp checksum" subcommand objtool/klp: Fix symbol resolution for duplicate data symbols powerpc/xive: make xive IPI allocation NULL-safe powerpc/xive: add error return value to xive_smp_probe() powerpc/xive: propagate IPI init errors to prevent use-after-free serial: core: do fallible allocations before the console can be registered serial: core: clear freed pointers on uart_register_driver() failure tty: skip cdev_del() when no cdev is registered PCI: dwc: ep: Flush cached MSI write before unmapping the iATU PCI: dwc: ep: Fix unmap potentially unmapping the wrong iATU HID: asus: refactor the two workqueues and init sequence HID: asus: fix a off-by-one in mcu_parse_version_string() validation HID: logitech-hidpp: Fix FF device cleanup on init failure block/blk-iolatency: account per-cpu latency stats over possible CPUs ublk: validate auto buf reg before taking uring_cmd ocfs2: validate inline xattr header before ibody lookups ocfs2: validate inline xattrs during inode block validation ocfs2: validate external xattr entries when reading metadata ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full() ublk: clear auto buf reg before updating io->buf in batch commit ALSA: hda/realtek: ALC269 fixup for Yoga/Legion Mic noise PCI/sysfs: Add static PCI resource attribute macros PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers selftests/mm: fix mmap() return value check in run_migration_benchmark selftests/mm: fix memleak in migration benchmark arm64: dts: qcom: sa8540p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sdm845: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sdm850: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8150: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8250: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8350: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8450: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8550: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: qcm6490: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: qcs6490: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sc7180: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sc7280: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sc8180x: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: hamoa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: purwa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8650: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sm8750: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: lemans: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies arm64: dts: qcom: sa8155p-adp: Fix swapped USB and UFS QMP PHY vdda-phy/vdda-pll supplies thermal: hwmon: Remove hwmon class device along with its parent xen/xenbus: check otherend_id only after it has been initialized perf header: Use write lock when translating BPF prog info pointers ocfs2/heartbeat: fix slot mapping rollback leaks on error paths ocfs2: o2hb: quiesce negotiate handlers and timeout work bpf: Factor callchain_store function from __bpf_get_stack bpf: Factor callchain_finalize function from __bpf_get_stack bpf: Remove trace_in argument from __bpf_get_stack bpf: Clear buf on error in __bpf_get_task_stack perf c2c: Fix error masking, OOM, and unchecked caller errors in hpp_list__parse() perf c2c: Clean up registered formats on c2c_hists__init() and c2c_hists__reinit() failure drm/sun4i: Fix V3s YUV scanline size drm/sun4i: vi scaler: Restore opaque alpha in video modes drm/sun4i: tcon-top: Keep mixer routes distinct drm/sun4i: Drop node references while building component list soundwire: cadence_master: add BRA_NumBytes[8] support tools: Ensure tools copy of linux/filter.h exports the UAPI drm/gfx12: Program DB_RING_CONTROL drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 drm/amd/display: Resize MST HDCP per-connector arrays to 32 ALSA: hda: cix-ipbloq: Avoid build with 32bit archs phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure PCI: cadence: Fix host/endpoint dependencies for cadence-plat driver selftests/mm: unpoison pages in memory-failure teardown ext4: teach ext4_meta_trans_blocks() about number of allocated extents ext4: fix transaction overflow during writeback coresight: etm4x: Set active path on target CPU coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt arm_mpam: Disable driver unbind to avoid UAF ACPI: PCI: Avoid misleading _OSC messages for non-PCIe host bridges without _OSC scsi: sd: Enable sector size > PAGE_SIZE in SCSI sd driver scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock btrfs: check if root is readonly when setting posix acl btrfs: zoned: flush active metadata block group at btree_writepages() start perf sched: Suppress latency table output when trace samples are missing perf header: Add utility to convert feature number to a string perf header: Refactor pipe mode end marker handling perf sched: Handle missing trace samples in pipe mode Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind perf script: Fix metric_evlist leak in script_find_metrics perf tools: Fix sb_evlist leaks in top and record perf python: Fix memory leak in pyrf_evlist__get_pollfd perf python: Validate attribute setters in pyrf_evsel perf python: Fix count_values memory leak in pyrf_evsel__read apparmor: fix integer overflow in verify_tags() bounds check iommu/vt-d: Fix iopf_refcount leak on RID domain replacement netfilter: nft_ct: support expectation creation for natted flows netfilter: nf_conntrack_helper: add refcounting from datapath netfilter: nft_ct: move custom expectation support to helper nfsd: add protocol support for CB_NOTIFY lockd: Regenerate NLMv4 XDR code xdrgen: Emit a blank line ahead of enum declarations xdrgen: Add XDR width macros for short integer types NFS: Return a delegation the client fails to record selftests/cgroup: Avoid awk -e in cpuset tests pinctrl: rockchip: Decode drive strength in the get function selftests: drv-net: Test queue stall upon reconfig selftests: drv-net: so_txtime: remember to deploy the binaries selftests: drv-net: so_txtime: only send test traffic to sch_etf apparmor: fix unconfined user namespace restriction forced stack phy: rockchip: samsung-hdptx: Fix rate recalculation for high bpc phy: rockchip: samsung-hdptx: Prevent divide-by-zero when computing clk rate phy: rockchip: samsung-hdptx: Guard against clk rate integer underflow phy: rockchip: samsung-hdptx: Fix rate recalculation for 3.2GHz FRL phy: rockchip: samsung-hdptx: Handle uncommitted PHY config changes bpf: Compare iterator types during state pruning objtool/klp: Fix vmlinux .klp.symid link error for .no_trim_symbol symbols objtool/klp: Fix size of empty special section entries objtool/klp: Ignore replacement offset of empty x86 alternatives objtool/klp: Fix cross-module klp relocation section naming objtool/klp: Don't match local symbols against exports objtool/klp: Fix relocations for EXPORT_SYMBOL_FOR_MODULES() symbols iomap: iomap_bio_read_folio_range_sync is missing a call to bio_uninit arm64/efi: Avoid voluntary preemption with efi_mm installed mfd: cs42l43: Fix regmap defaults ordering backlight: aw99706: Validate all DT property values consistently backlight: ktd2801: Fix unmet dependency on GPIOLIB bpf, riscv: Clear fetch destination on faulting arena atomic bpf, x86: Clear fetch destination on faulting arena atomic bpf: Derive the atomic load register in one place bpf, arm64: Clear fetch destination on faulting arena atomic bpf, s390: Clear fetch destination on faulting arena atomic ASoC: spacemit: advertise only DMA-backed DAI streams objtool/klp: Fix vmlinux .klp.symid link error for .exitcall.exit symbols power: supply: bd71815: Fix temperature reading power: supply: bd71828: Fix current direction power: supply: bd71828: Drop duplicate power-supply property power: supply: bd71828: Do not hide errors selftests: drv-net: so_txtime: fix qdisc replace with handle sched/isolation: Defer freeing of cpumask memblock memory to initcall clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type nvmet: fix max_qid race between configfs and controller allocation HID: tmff: Use 64-bit arithmetic for force feedback scaling bpf: Fix arm64 KASAN false positive after bpf_throw ACPI: bus: Introduce acpi_bus_get_primary_device() ACPI: platform: Use acpi_bus_get_primary_device() ACPI: scan: Use acpi_bus_get_primary_device() selftests/bpf: Fix selftest build after filter.h update sched_ext: Drop unlocked scx_rq_clock_invalidate() from scx_root_disable() blk-iolatency: clear delay state when freeing policy data blk-iocost: clear delay state when freeing policy data bpf: Check pointer type for all atomic RMW paths ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() smb/server: abort initialization when proc setup fails smb/server: call ksmbd_proc_cleanup() on module init failure smb/server: fix memory leak in ksmbd_vfs_set_durable_owner() objtool/klp: Fix vmlinux klp relocations for EXPORT_SYMBOL_FOR_MODULES() ksmbd: safely discard unregistered deferred locks ksmbd: validate SMB2 write offsets ksmbd: fix encrypted request lookup on bound channels ksmbd: scope session state changes to bound connections ksmbd: add procfs monitoring for active shares smb/server: warn if ksmbd_proc_create() fails smb/server: update session counter under sessions table lock smb/server: fix session counter on session removal selftests/bpf: Retry stat generation in cgroup_iter_memcg NFS: Fix delayed delegation return list handling regulator: tps65185: wait for the IC to wake before the first I2C access can: m_can: Use of_property_present() for wakeup-source ionic: add missing dma_rmb() after the completion publish check virtio_net: Fix resize of the RX ring netfilter: ctnetlink: do not expose expectation DEAD flag i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode smb: client: set replay flag on the read send-error retry path irqchip/gic-v5: Clear per-CPU IRS data on teardown irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing irqchip/gic-v5: Disable IRSes on probe failures irqchip/gic-v5: Release IRS iomem region on driver init failure irqchip/gic-v5: Defer default SPI and LPI IAFFID programming drm/xe: don't WARN on kernel job timeout when device already wedged ip6mr: do not clone dst in ip6mr_cache_report() powercap: intel_rapl: Sign-extend the PMU delta on counter wraparound net: bridge: arp/nd proxy: fix reading neigh ha vxlan: fix reading neigh ha NFSv4.1: zero referring call lists before decoding ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS net/sched: account classifier filter allocations to memcg net: hibmcge: fix page_pool DMA direction mismatch net/sched: sch_cake: fix autorate reconfiguration throttling fuse: use release/acquire for fch->initialized fuse: Fix the condition to enable over-io-uring f2fs: use adjusted write range after f2fs_write_checks() Bluetooth: L2CAP: access chan->conn safely in get/setsockopt Bluetooth: hci_sync: add conditional locking annotations Bluetooth: do not leak an hci_conn when a second LE connect is rejected net: enetc: extract common helpers for MAC promiscuous mode setting net: enetc: extract common helpers for MAC hash filter configuration net: enetc: remove invalid code from enetc4_pl_mac_link_up() net: enetc: restore RX ring congestion mode for ENETC v4 net: mana: Cap MSI-X vectors to the device MSI-X table size octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init() smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() smb/client: pass cifs_open_info_data to SMB2_open() smb/client: preserve open info type across compound queries selftests/mm: fix read_file() return value check of/irq: Fix device node refcount leak in of_irq_get_affinity() net: phy: air_en8811h: move LED GPIO configuration to config_init netfilter: nf_tables: skip double clone set expressions on element insert net: stmmac: selftests: Don't test flow control for small rx fifos Revert "esp: do not unref managed frag pages in esp_ssg_unref()" perf hists browser: Increase MAX_OPTIONS to prevent stack buffer overflow perf ui hists: Fix dso_filter reference leak and exit zoom cleanup perf python: Add missed explicit dependencies EDAC/igen6: Fix Raptor Lake-P logged error address nvme: add context annotations for nvme_subsystem::lock nvme: set ns->head in nvme_alloc_ns_head nvme: fix racy access to FDP placement id array selftests/cgroup: set the test plan after the setup checks bpf: Fix BPF_F_CPU validation for sparse CPU IDs bpf: Fix percpu map update indexing with sparse CPU IDs printk: Don't WARN on kthread_run failure. selftests/cgroup: Drop invalid boot isolation comparison cgroup/cpuset: Preserve boot-isolated CPUs on partition release accel: ethosu: Don't read the U65 rounding mode as a storage mode bpf: check_cond_jmp_op(): properly infer if register is null net: stmmac: helpers for filling tx_q->tx_skbuff_dma net: stmmac: add helper to get hardware transmit descriptor net: stmmac: fix dma mapping leak in stmmac_tso_xmit() scsi: ufs: core: Introduce a new ufshcd vops negotiate_pwr_mode() smb/client: fix stale page cache in insert/collapse range smb/client: invalidate fscache for fallocate range operations netfs: Fix readahead synchronisation issues by loading all folios upfront netfs: Mark folios with COPY_TO_CACHE whilst issuing subreqs netfs: Fix read progress reporting drm/i915/cdclk: Fix dg2_power_well_count() return type ovl: return EINVAL instead of EIO in case of mismatched user_ns smb/server: cancel async requests when closing connection ksmbd: safely drain sessions during logoff ksmbd: fix listener task lifetime on netdev events s390/pai: Reduce excessive debug feature size ASoC: ab8500: Skip missing DMIC GPIOs on AB8505 drm/pagemap: Prevent double migration of device pages drm/pagemap: Reset migration page count on eviction retry rust: samples: add missing newlines in rust_print_main klp-build: Fix wrong index in funcs cleanup error path objtool/klp: Fix checksums for constant pool references ipv6: mcast: fix delay calculation in igmp6_join_group() ipv6: mcast: use rcu_assign_pointer() for __rcu list updates ipv6: mcast: use jiffies_delta_to_clock_t() in igmp6_mc_seq_show() net: bonding: annotate lockless writes with WRITE_ONCE() ASoC: cs35l56: Request IRQ in cs35l56_common_probe() ASoC: cs35l56: Fix probe deadlock waiting for SoundWire enumeration sched/core: Skip rq->avg_idle update without a valid idle_stamp ksmbd: fix sparc build with atomic work state bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks net: macb: exclude software FCS from TX byte statistics powerpc: Don't drop _TIF_RESTOREALL on syscall restart bpf: Reject key-less BTF for hash maps bpf: Mark syscall helpers as sleepable ring-buffer: Add checking nr_subbufs to persistent ring buffer validation nvme: print namespace IDs as unsigned 32bit value nvmet: print namespace IDs as unsigned 32bit value bpf: zero extend the result of an arena 32-bit cmpxchg bpf: don't rewrite bpf_fastcall patterns entered by a jump bpf: Don't infer non-NULL from a pointer with an unbounded offset bpf: detect non null pointer with register operand in JEQ/JNE. bpf: Mark the zero register precise for a register-form NULL check bpf: Mark NULL kptr stores precise bpf: Preserve inner map identity in callback frames ring-buffer: Remove ring_buffer_per_cpu::mapped tracing: Fix subbuf resize races with trace_pipe_raw readers ring-buffer: Cap static ring buffer nr_pages tracing: Fix comment in tracing_buffers_splice_read() bpf: mark a NULL call argument precise bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero() net/mlx5e: Fix reporting support for all RS FEC variants erofs: delimit inode_share cache key components iommu/riscv: Serialize command queue publishing iommu/riscv: Avoid waiting on failed command enqueue iommu/amd: Fix ineffective error check in nested domain allocation regulator: pf1550: fix which regulator is notified virtio_ring: fix stale descriptor flags after a failed packed add vduse: validate virtqueue alignment vhost: invalidate vring access on IOTLB transitions vduse: return compat ioctl results directly net: macb: zero the link settings taprio reads back net: macb: reject an unknown link speed in the taprio setup Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform nstree: check listing permission before taking a namespace reference drm/xe: Guard page-fault worker with runtime PM check net: phylink: initialise link_state before a forced major config drm/i915/dp: Gate UHBR SST SDP splitting on sink capability block: Fix start and length check added to iov_iter_extract_bvecs() ublk: clear force_abort in ublk_queue_reset_io_flags() tracing: Fix ring_buffer_read_page_size() kernel-doc x86/MCE/AMD: Fix inverted interrupt enablement during storm handling ftrace: Use rcu_assign_pointer() for tmp_ops filter hash tracing: Take trace_array reference when opening a tracer options file tracing: Don't dereference trace_event_file in deferred trigger free rust: num: seal Integer rust: pin-init: use irrefutable pattern for `stack_pin_init` riscv: hwprobe: initialize pair->value in hwprobe_one_pair() drm/amdgpu: statically assign gart windows to ttm entities drm/amdgpu: skip the VMID 0 flush for VRAM accel: ethosu: Fix ethosu_job_open() return value accel: ethosu: Drop IRQF_SHARED flag accel: ethosu: Ensure cmd stream ends with a stop op accel: ethosu: Ensure SRAM size is 0 on mapping failure accel: ethosu: Validate SRAM size on submit accel: ethosu: Ensure SRAM region size matches job ata: pata_legacy: remove documentation for removed module parameters drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 drm/amd/display: Exit IPS before connector detection on resume selftests: ublk: install test_common.sh and trace/ scripts media: rkvdec: bound HEVC tile loops and PPS id to the array capacity selftests: mptcp: lib: dump nstat for the right test selftests: mptcp: lib: get counters for the right test smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() cifs: validate full SID length in security descriptors smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid smb: client: fix uid/gid override in getattr with posix extensions smb: client: fix cifsFileInfo reference leak in deferred close smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() xfs: lock the healthmon when inserting unmount event xfs: fix under-reservation of blocks when repairing sf directories xfs: fix media verification ioctl for internal rt volumes xfs: don't stash removename operations with unknown ftype xfs: check healthmon outbuffer space correctly xfs: bump lost_prev_errors if we lose even the healthmon lost event xfs: always set xfs_healthmon::first_event when inserting at front of list ASoC: cs35l56: Fix race between kexec and snd_soc_register_component() hwmon: (asus_rog_ryujin) Add per-device configuration hwmon: (asus_rog_ryujin) Validate HID report lengths hwmon: (asus_rog_ryujin) Synchronize HID command and report handling f2fs: fix to shrink gc_lock coverage in f2fs_gc_range() f2fs: fix to reset all pinned status during fggc drm/i915/cdclk: Avoid spurious cdclk sanitization on PTL+ accel/amdxdna: Disable device buffer exporting drm/xe/i2c: Assert/Deassert I2C IRQ drm/xe/i2c: Fix the interrupt handling s390/pai: Use PAI PMU index as parameter replacing event s390/pai: Move locking to event init and delete s390/pai: Support CPU hotplug for PMU PAI UBUNTU: Upstream stable to v6.18.52, v6.18.53, v7.2.6, v7.2.7 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169638/+subscriptions